DepClean

What is DepClean?

DepClean is a tool to automatically remove dependencies that are included in your Java dependency tree but are not actually used in the project's code. DepClean detects and removes all the unused dependencies declared in the pom.xml file of a project or imported from its parent. For that, it relies on bytecode static analysis and extends the maven-dependency-analyze plugin (more details on this plugin). DepClean does not modify the original source code of the application nor its original pom.xml. It can be executed as a Maven goal through the command line or integrated directly into the Maven build lifecycle.

How does it work?

DepClean runs before executing the package phase of the Maven build lifecycle. It statically collects all the types referenced in the project under analysis as well as in its declared dependencies. Then, it compares the types that the project actually use in the bytecode with respect to the class members belonging to its dependencies.

With this usage information, DepClean constructs a new pom.xml based on the following steps:

1. add all used transitive dependencies as direct dependencies
2. remove all unused direct dependencies
3. exclude all unused transitive dependencies

If all the tests pass, and the project builds correctly after these changes, then it means that the dependencies identified as bloated can be removed. DepClean produces a file named pom-debloated.xml, located in the root of the project, which is a clean version of the original pom.xml without bloated dependencies.

Usage

You can configure the pom.xml file of your Maven project to use DepClean as part of the build:

<plugin>
    <groupId>se.kth.castor</groupId>
    <artifactId>depclean-maven-plugin</artifactId>
    <version>1.1.0</version>
    <executions>
        <execution>
            <goals>
                <goal>depclean</goal>
            </goals>
        </execution>
    </executions>
</plugin>

Optional Parameters

The Maven plugin can be configured with the following additional parameters.

Name	Type	Description
<ignoreDependencies>	Set<String>	Add a list of dependencies, identified by their coordinates, to be ignored by DepClean during the analysis and considered as used dependencies. Useful to override incomplete result caused by bytecode-level analysis. Dependency format is: groupId:artifactId:version.
<ignoreScopes>	Set<String>	Add a list of scopes, to be ignored by DepClean during the analysis. Useful to not analyze dependencies with scopes that are not needed at runtime. Valid scopes are: compile, provided, test, runtime, system, import. An Empty string indicates no scopes (default).
<createPomDebloated>	boolean	If this is true, DepClean creates a debloated version of the pom without unused dependencies called debloated-pom.xml, in root of the project. Default value is: false.
<failIfUnusedDependency>	boolean	If this is true, and DepClean reported any unused dependency in the dependency tree, the build fails immediately after running DepClean. Default value is: false.
<skipDepClean>	boolean	Skip plugin execution completely. Default value is: false.

Installing and building from source

Prerequisites:

• Java OpenJDK 8 or above
• Apache Maven

In a terminal clone the repository and switch to the cloned folder:

git clone https://github.com/castor-software/depclean.git
cd depclean

Then run the following Maven command to build the application and install the plugin locally:

mvn clean install

Once the plugin is installed, you can execute the plugin goal directly in the command line:

mvn se.kth.castor:depclean-maven-plugin:1.1.0:depclean

The output is going to look like the following:

-------------------------------------------------------
 D E P C L E A N   A N A L Y S I S   R E S U L T S
-------------------------------------------------------
Used direct dependencies [6]: 
	org.weakref:jmxutils:1.19:compile
	com.google.guava:guava:23.0:compile
	com.alibaba:fastjson:1.2.38:compile
   	cglib:cglib:3.2.5:compile
   	org.mockito:mockito-all:1.8.5:test
	junit:junit:4.8.1:test    
Used transitive dependencies [4]: 
	org.apache.httpcomponents:httpcore:4.4.6:compile
	com.google.j2objc:j2objc-annotations:1.1:compile
	commons-codec:commons-codec:1.9:compile
	org.ow2.asm:asm:6.0_ALPHA:compile
Potentially unused direct dependencies [1]: 
   	commons-io:commons-io:2.5:compile
Potentially unused transitive dependencies [2]: 
	org.apache.ant:ant:1.9.6:compile
	org.codehaus.mojo:animal-sniffer-annotations:1.14:compile
[INFO] Starting debloating POM
[INFO] Adding 4 used transitive dependencies as direct dependencies.
[INFO] Removing 1 unused direct dependency.
[INFO] Excluding 2 potentially unused transitive dependencies one-by-one.
- Excluding org.apache.ant:ant:jar:1.9.6:compile from dependency Dependency {groupId=cglib, artifactId=cglib, version=3.2.5}
- Excluding org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile from dependency Dependency {groupId=com.google.guava, artifactId=guava, version=23.0}
[INFO] POM debloated successfully
[INFO] pom-debloated.xml file created in: /projectdir/pom-debloated.xml
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------

License

Distributed under the MIT License. See LICENSE for more information.

Funding

DepClean is partially funded by the Wallenberg Autonomous Systems and Software Program (WASP).