Hi. I have a recurring maven(?) issue that I hope is not unique to me and has been solved by someone somewhere.

As JSON parser, I use JSON-Java (the one with package org.json), instead of more famous ones, as the DX and API feel more fit for most/all my projects.

However, from time to time, I reach a very dreadful situation, where the "version" of the JSON-Java library that is available to my code is "not" the one that I have declared in my pom.xml file. In once case, the copyright notice in the source that I could see by clicking the class name in VSCode was from 2010, with the painful difference to the modern version that all parsing methods threw checked exceptions. In another instance, the JSONArray class did not implement Iterable/Iterator where in modern versions it does.

This is likely a maven transitive dependency issue, but the reason it is so visible for this particular library, is because either many libraries already have their own dependency on it, or that it's interface has evolved quite significantly along the way. Likely both.

The solution "in the book" for this is apparently to do "mvn dependency:tree" and exclude JSON-Java explicitly from other dependencies that depend on it. But it doesn't work for me! In my dependency three, only the recent version that is in my own pom file is shown, whereas in code/IDE (VSCode + IntelliJ), I can only use the old version. My deployment involves building a fat Jar, so it happens there too.

Am I doing something wrong? Is there a proven way to make only a certain version of a dependency available to my code, regardless of other versions that may be present deeper in the class path? Does the order of dependencies in pom file matter? and how can I strictly control the versions of dependencies that appear in my fat jar, in case it is possible at all?

Many thanks