Maven does not write a lockfile the way npm does. It resolves the versions you declare, so you pin by using exact versions, controlling transitive versions with dependencyManagement, failing the build on conflicts with the enforcer plugin, and verifying checksums. Gradle, by contrast, has built-in dependency locking.
What is the difference between a lockfile and a pinned version?
A lockfile records the full resolved graph, including transitive dependencies, so a later build reproduces it. A pinned version fixes one declared dependency. In Maven, the pom declares direct dependencies. Transitive ones come from the poms of those dependencies, and where two paths disagree Maven picks a version by its mediation rules, nearest definition wins. A change in an upstream pom can therefore change what your build resolves, even with no change in your own file.
The Maven documentation read for this post describes no built-in equivalent of a lock state. Check your own Maven version and plugins before you assume one exists.
How do you pin in Maven?
Four techniques work together.
- Exact versions. Avoid version ranges and the old
LATESTandRELEASEkeywords. The enforcer plugin has a rule to require release dependencies, so snapshots do not slip into releases. - dependencyManagement. Declare the version of every dependency you care about, including transitive ones, in the managed section. That overrides what the dependency tree would choose.
- Dependency convergence. The enforcer plugin's convergence rule fails the build when two paths to the same artifact bring different versions. Its documentation shows an error naming the paths, for example two routes to a jaxen artifact with versions 1.1.3 and 2.0.0. You then resolve it by exclusion or management.
- Checksums. Maven Resolver compares the checksum of a downloaded artifact to an expected value. Its documentation describes strategies for getting the expected value and mentions a trusted checksum mechanism, where known-good checksums are supplied up front rather than fetched from the same remote.
A constructed example: your service depends on library A, which depends on a JSON library at version 2.10. Another dependency pulls version 2.15 deeper in the tree. Mediation picks one depending on tree shape. Adding a convergence rule makes the build fail until you manage the version explicitly, so the choice is yours and is recorded in the pom.
What does Gradle do differently?
Gradle documents dependency locking: it writes lock state files recording the resolved versions, and builds run with the lock state present. Its docs warn that dynamic versions such as 1.+ or a range can break builds unexpectedly because the resolved version changes over time, and describe lock modes, selective updates and limitations. If you work in a mixed estate, that comparison is useful.
Why does Maven Central matter here?
Pinning protects you from surprise changes, not from a bad version. If you pin to a version that is later found vulnerable or malicious, the pin keeps you on it. So pair pinning with a scanner that reads your resolved tree. Safeguard's SBOM and dependency scanning can read a Maven project, list direct and transitive components and show which known issues are reachable.
What to do
- Replace ranges,
LATEST,RELEASEand snapshots in release builds with exact versions. - Put versions for all important dependencies, including transitive ones, in dependencyManagement or a bill of materials you control.
- Add the enforcer plugin with dependency convergence and require-release-dependencies rules.
- Use your repository manager as the only source for builds and keep checksums enforced.
- Generate an SBOM from the resolved tree on each release and store it.
- Schedule a regular, reviewed update, since pins age.
Quick check
Does a pom pin transitive dependencies?
Not by itself. Transitive versions come from other poms and mediation, unless you set them in dependencyManagement.
Does Gradle have lockfiles?
Yes. Its documentation describes dependency locking with lock files that record resolved versions.
Sources
- Maven Enforcer: dependencyConvergence rule
- Maven Enforcer: requireReleaseDeps rule
- Maven Resolver: expected checksums
- Gradle: dependency locking
Last reviewed: 18 October 2026.
