Maven Enforcer "Dependency convergence error" - Fix in CI

The enforcer DependencyConvergence rule found two paths through your dependency tree that pull different versions of the same artifact. The rule fails the build until every path agrees on one version - Maven would otherwise silently pick one and risk a runtime mismatch.

What this error means

The build fails (usually in the validate phase) with Dependency convergence error for <groupId>:<artifactId> and a list of the conflicting versions plus the paths that introduce each. It fails identically every run. This is a guardrail, not a flake.

mvn output

[WARNING] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed with message:
Failed while enforcing releasability.
Dependency convergence error for com.google.guava:guava:31.1-jre paths to dependency are:
+-com.example:app:1.0.0
  +-com.foo:lib-a:2.0 -> com.google.guava:guava:31.1-jre
and
+-com.example:app:1.0.0
  +-com.bar:lib-b:3.1 -> com.google.guava:guava:32.1.2-jre

Common causes

Two dependencies pull different versions transitively

Library A depends on guava:31.1-jre and library B on guava:32.1.2-jre. Without an explicit pin, the tree contains both, and DependencyConvergence refuses to let that ambiguity through.

A transitive bump drifted away from your managed version

Upgrading one dependency can pull a newer transitive version of a shared library, breaking a convergence that previously held.

How to fix it

Pin the conflicting artifact in dependencyManagement

Force a single version so every path converges on it.

pom.xml

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.google.guava</groupId>
      <artifactId>guava</artifactId>
      <version>32.1.2-jre</version>
    </dependency>
  </dependencies>
</dependencyManagement>

Find every conflicting path first

List the verbose tree so you pin a version compatible with all consumers.

Terminal

mvn dependency:tree -Dverbose -Dincludes=com.google.guava:guava

How to prevent it

Manage shared library versions centrally in dependencyManagement (or import a BOM).
Run mvn dependency:tree -Dverbose after dependency bumps to catch new divergence.
Keep the DependencyConvergence rule on - it surfaces version drift before runtime.