DepClean

• What is DepClean?
• Usage
• Optional Parameters
• How does DepClean work?
• Gradle Plugin
• Installing and building from source
• Citation
• Contributing
• License
• Funding

DepClean is a Maven plugin that automatically detects and removes unused dependencies declared in a project's pom.xml file, imported transitively through other dependencies, and even those inherited from a parent POM.

It can be executed via the command line as a Maven goal or seamlessly integrated into the Maven build lifecycle (e.g., in CI/CD pipelines).

Importantly, DepClean does not modify your source code or original pom.xml file.

• Automatically detects and removes unused dependencies from the pom.xml, including those inherited from parent projects.
• Analyzes bytecode of any Java version, up to the latest release, ensuring compatibility with modern Java features.
• Runs on Java 8 and above: the plugin ships Java 8 bytecode, so it works on legacy toolchains while still analyzing modern bytecode.
• Generates a clean and minimal pom.xml, free from unused dependencies.
• Produces detailed, per-dependency usage reports.
• Offers fine-grained configuration options to tailor the analysis and cleaning process.
• Integrates directly into the Maven build lifecycle.
• Handles multi-module Maven projects out of the box.
• Ignores some dependencies used only via reflection (e.g., frameworks like Spring or Hibernate).
• Includes support for annotation processors.
• Analyzes fat JARs, shaded dependencies, and repackaged libraries.

For a visual overview of how DepClean works and what it can do for your project, check out the companion project: depclean-web.

✨ DepClean is the result of academic research conducted at KTH Royal Institute of Technology in Sweden. It was introduced in the paper: "A Comprehensive Study of Bloated Dependencies in the Maven Ecosystem" (DOI: 10.1007/s10664-020-09914-8)

DepClean requires Maven 3.9+ and runs on any JVM from Java 8 upwards, regardless of the Java version your project targets.

Configure the pom.xml file of your Maven project to use DepClean as part of the build:

<plugin>
  <groupId>se.kth.castor</groupId>
  <artifactId>depclean-maven-plugin</artifactId>
  <version>2.1.0</version>
  <executions>
    <execution>
      <goals>
        <goal>depclean</goal>
      </goals>
    </execution>
  </executions>
</plugin>

Or you can run DepClean directly from the command line (the project needs to be compiled first, including its test classes):

cd {PATH_TO_MAVEN_PROJECT}
mvn test-compile
mvn se.kth.castor:depclean-maven-plugin:2.1.0:depclean

The examples above use the latest release published to Maven Central. To try the latest snapshot instead, build from source.

Let's see an example of running DepClean in the project Apache Commons Numbers!

The Maven plugin can be configured with the following additional parameters.

You can integrate DepClean in your CI/CD pipeline. For example, if you want to fail the build in the presence of unused direct dependencies, while ignoring all the dependency scopes except the compile, use the following plugin configuration.

<plugin>
  <groupId>se.kth.castor</groupId>
  <artifactId>depclean-maven-plugin</artifactId>
  <version>2.1.0</version>
  <executions>
    <execution>
      <goals>
        <goal>depclean</goal>
      </goals>
      <configuration>
        <failIfUnusedDirect>true</failIfUnusedDirect>
        <ignoreScopes>provided,test,runtime,system,import</ignoreScopes>
      </configuration>
    </execution>
  </executions>
</plugin>

Of course, it is also possible to execute DepClean with parameters directly from the command line. The previous example can be executed directly as follows:

mvn se.kth.castor:depclean-maven-plugin:2.1.0:depclean -DfailIfUnusedDirect=true -DignoreScopes=provided,test,runtime,system,import

DepClean runs before executing the package phase of the Maven build lifecycle. It statically collects all the types referenced in the project under analysis as well as in its declared dependencies. Then, it compares the types that the project actually uses in the bytecode with respect to the class members belonging to its dependencies.

With this usage information, DepClean constructs a new pom.xml based on the following steps:

1. add all used transitive dependencies as direct dependencies
2. remove all unused direct dependencies
3. exclude all unused transitive dependencies

If all the tests pass, and the project builds correctly after these changes, then it means that the dependencies identified as bloated can be removed. DepClean produces a file named pom-debloated.xml, located in the root of the project, which is a clean version of the original pom.xml without bloated dependencies.

A prototype Gradle plugin providing a debloat task for Gradle-based Java projects is available in this repository. It is not yet published to a plugin portal and must be built from source. See the DepClean Gradle plugin README for usage and configuration details.

Prerequisites:

• Java OpenJDK 21 or above to build (the Maven plugin itself targets Java 8 bytecode and runs on Java 8+)
• No Maven installation needed — the Maven wrapper is included

In a terminal clone the repository and switch to the cloned folder:

git clone https://github.com/ASSERT-KTH/depclean.git
cd depclean

Then run the following command to build the application and install the plugin locally:

./mvnw clean install

If you use DepClean in academic work, please cite the original paper (see also CITATION.cff):

@article{SotoValero2021,
  title     = {A comprehensive study of bloated dependencies in the {Maven} ecosystem},
  author    = {Soto-Valero, C{\'e}sar and Harrand, Nicolas and Monperrus, Martin and Baudry, Benoit},
  journal   = {Empirical Software Engineering},
  volume    = {26},
  number    = {3},
  pages     = {1--44},
  year      = {2021},
  doi       = {10.1007/s10664-020-09914-8}
}

Contributions are welcome! See the contributing guidelines for how to build the project and submit a pull request. Feel free to open an issue for bug reports or feature suggestions — for security vulnerabilities, please follow the security policy instead. The Gradle plugin in particular is actively looking for contributors.

Distributed under the MIT License. See LICENSE for more information.

DepClean is partially funded by the Wallenberg Autonomous Systems and Software Program (WASP).