How do I read a Maven dependency tree

I have servlet-api version 2.5 as provided scope in pom.xml. Here is part of the dependency:tree output of my project. What does "version managed from 2.3; scope managed from compile" mean?

[INFO] +- commons-logging:commons-logging:jar:1.1:compile
[INFO] |  \- javax.servlet:servlet-api:jar:2.5:provided (version managed from 2.3; scope managed from compile)

Does that mean there is some transitive dependency on version 2.3 on my classpath? My WAR file does not have servlet-api jar at all, but I do use old version of Spring 2.5.4. I suspect the Spring framework depends on servlet-api 2.3.

Solution 1:

The message basically means that the version of servlet-api would have transitively been 2.3 (so basically in commons-logging's pom they define servlet-api with version 2.3), but that version 2.5 was specifically asked for in your project, so that is what was used.

Same goes for the scope. In commons-logging's pom it is defined with scope compile, but you have it defined with scope provided, so again that is the scope that was used.

Solution 2:

It means that your project has overridden the version and scope from other dependencies.