Starters and Dependency Management

After this page you can

• Explain what a starter is versus the dependency BOM
• Override a managed version safely
• Exclude a transitive dependency

01Definition

A starter is one dependency that pulls in everything a feature needs. For example, spring-boot-starter-web brings Spring MVC, JSON support and a server. The Boot BOM supplies tested versions, so you leave version numbers out.

02Why it exists

Picking compatible versions of many libraries by hand leads to conflicts that only appear at runtime. Starters and the BOM give you a set that is known to work together.

03How it works

Two separate ideas

1. Starters bundle the right libraries for a purpose.
2. Dependency management (the Boot BOM) fixes the version of each library so you rarely write one.

Starters decide what is on the classpath; auto-configuration then looks at the classpath and decides what beans to create. That is the link between them: add spring-boot-starter-data-jpa and a DataSource, EntityManagerFactory and transaction manager appear.

Frequently used starters

Starter	Gives you
spring-boot-starter-web	Spring MVC, Jackson, embedded Tomcat
spring-boot-starter-webflux	Reactive stack on Netty
spring-boot-starter-data-jpa	Hibernate, Spring Data JPA, HikariCP
spring-boot-starter-validation	Jakarta Bean Validation (Hibernate Validator)
spring-boot-starter-security	Spring Security
spring-boot-starter-actuator	Production endpoints and metrics
spring-boot-starter-test	JUnit 5, Mockito, AssertJ, Spring Test

04Example code

Getting the BOM

Option A: inherit from the parent POM.

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.5.6</version>
</parent>

The parent also configures Java version defaults, UTF-8, resource filtering and the repackage plugin.

Option B: import the BOM when you already have a corporate parent.

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-dependencies</artifactId>
            <version>3.5.6</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

Overriding a managed version

When a CVE fix is out and Boot has not bumped it yet, override the property the BOM uses:

<properties>
    <jackson-bom.version>2.18.2</jackson-bom.version>
</properties>

(Check the property name in spring-boot-dependencies for your Boot version.) Prefer waiting for a Boot patch release when possible: Boot tests its own combinations.

Excluding a transitive dependency

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
    <exclusions>
        <exclusion>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-tomcat</artifactId>
        </exclusion>
    </exclusions>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jetty</artifactId>
</dependency>

Inspect what you actually have with:

mvn dependency:tree -Dincludes=org.apache.tomcat.embed

05System design considerations

• Run a dependency report and vulnerability scan in CI
• Use dependency management in a parent POM or Gradle platform for multi-module builds
• Review what a new starter auto-configures before enabling it in production

06When to use it, and when not

Use it when

• You add a feature (web, security, JPA, Kafka) and want compatible dependencies
• You manage versions across modules with one BOM
• You exclude or replace one transitive library

Think twice when

• You override many managed versions, which loses the tested alignment
• You add starters you do not use and trigger unwanted auto-configuration
• A small library without Boot integration is all you need

07Common mistakes

• Pinning a version of a managed library "just in case"; it silently drifts from what Boot tested.
• Mixing two Spring Boot versions through different starters.
• Both starter-web and starter-webflux present: Boot chooses the servlet stack and WebFlux's WebClient runs, but your app is not reactive end to end.

08Interview questions

1. What is a starter?

A convenience dependency that transitively brings everything for one capability. It contains no logic; auto-configuration in the Boot jars reacts to what it puts on the classpath.

2. Why do you not specify versions for most dependencies?

The Boot parent (or imported BOM) has a dependencyManagement section pinning compatible versions of hundreds of libraries.

3. What is the difference between the parent POM and importing the BOM?

The parent also sets plugin configuration and build defaults. Importing the BOM only provides version management, which is what you need when you cannot change your parent.

4. How do you resolve a version conflict with a transitive dependency?

Check mvn dependency:tree, then either override the BOM property, add an explicit dependencyManagement entry, or exclude the offender.

09Check yourself

Quick quiz3 questions

1What is a starter?

2What does the Boot BOM (spring-boot-dependencies) provide?

3How do you override a managed version in Maven?

10Key takeaways

• Starters bundle libraries; the BOM pins their versions.
• Auto-configuration reads the classpath that starters build.
• Override via properties or dependencyManagement, exclude via <exclusions>, and verify with dependency:tree.

Next: Externalized configuration.

Next topicAuto-configuration→