During Maven build, sure. But it does not add unknown dependencies to your code at runtime. I am used to classpath problems with surefire but that it downloads

During Maven build, sure. But it does not add unknown dependencies to your code at runtime. I am used to classpath problems with surefire but that it downloads undeclared stuff is new to me. Afair it pulls only in transitive dependencies. Could you give an example? I am mainly building war files and it turned out to be good practice to explicitely declare any ambigous transitive dependencies. There's even a Maven plugin which shows up classes with different hash during build, https://basepom.github.io/dependency-versions-check-maven-plugin/release-4.0.0/ https://basepom.github.io/dependency-versions-check-maven-pl...