Apache Ivy
What Apache Ivy is
Apache Ivy is a free, open-source dependency manager centered on Java projects, while also handling dependencies of other kinds. It integrates with Apache Ant, adding dependency management to Ant build files, and resolves transitive dependencies from module metadata. Ivy accepts Ivy files, Maven 2 POMs, and custom module descriptors, with OSGi bundles listed among its package formats. Repositories can be extended, and users can define version-selection strategies, conflict managers, and module metadata. A cache avoids repeated downloads, while publishing supports multi-project environments. Ivy creates HTML reports for immediate dependencies and graph reports for transitive dependencies and conflicts. The core engine is a single JAR requiring JRE 1.4 or later; binary distributions work with Apache Ant 1.6.2 or later. The listed available release is 2.6.0, which fixes a path-traversal vulnerability affecting versions through 2.5.3. Most Ivy code is not thread-safe.
Who it suits
Apache Ivy suits Java developers using Ant who need configurable dependency resolution, repository support, publishing, and dependency reports. It can also manage dependencies outside Java-specific projects.
What it does well
- Free and open source under Apache License 2.0
- Integrates dependency management with Apache Ant
- Resolves transitive dependencies
- Supports configurable repositories and conflict managers
- Produces HTML and graph dependency reports
What to know first
- Most code is not thread-safe
- Ant parallel-task use is unsupported
- Requires JRE 1.4 or later
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Apache Ivy | Open source dependency manager | Free |
As ant.apache.org lists them, read 12 Oct 2026. The maker's own page has the final word.
Verdict
Apache Ivy provides configurable dependency resolution and reporting for Ant-based Java work. Its lack of thread safety matters for teams considering parallel Ant tasks.
Facts from Apache Ivy's own pages
- Ant integration
- Ivy integrates with Apache Ant and provides Ant tasks for dependency resolution, reporting, and publication. · ant.apache.org, 12 Oct 2026
- Caching
- Ivy uses a cache to avoid duplicate dependency downloads. · ant.apache.org, 11 Oct 2026
- Current release
- The download page lists Apache Ivy 2.6.0 as available. · ant.apache.org, 12 Oct 2026
- Dependency reports
- Ivy generates HTML and graph reports that show dependencies, transitive dependencies, and conflicts. · ant.apache.org, 12 Oct 2026
- Dependency resolution
- Ivy manages transitive dependencies and provides configurable conflict management to select versions. · ant.apache.org, 11 Oct 2026
- Distribution formats
- The download page provides binary, binary-with-dependencies, and source distributions in ZIP and tar.gz archives. · ant.apache.org, 11 Oct 2026
- Download verification
- The project recommends verifying downloaded releases with PGP signatures or SHA512 checksums. · ant.apache.org, 12 Oct 2026
- Extensibility
- Users can plug in repositories and define custom version strategies, conflict managers, and module metadata. · ant.apache.org, 12 Oct 2026
- Free plan
- Yes · ant.apache.org, 21 Sept 2026
- Java dependencies
- Ivy is oriented toward Java dependency management but can manage dependencies of any kind. · ant.apache.org, 12 Oct 2026
- Latest listed version
- The download page lists Apache Ivy 2.6.0 as available. · ant.apache.org, 11 Oct 2026
- License
- Apache Ivy is free and open source under the Apache License, Version 2.0. · ant.apache.org, 11 Oct 2026
- Open source license
- Ivy is free and open source under the Apache License, Version 2.0. · ant.apache.org, 12 Oct 2026
- Package formats
- Ivy files,Maven POMs,OSGi bundles · ant.apache.org, 21 Sept 2026
- Private registry auth
- Yes · ant.apache.org, 21 Sept 2026
- Publishing
- Ivy can publish projects to a repository to support multi-project environments. · ant.apache.org, 11 Oct 2026
- Purpose
- Apache Ivy manages project dependencies by recording, tracking, resolving, and reporting them. · ant.apache.org, 12 Oct 2026
- Release verification
- The project recommends verifying downloaded release files with PGP signatures or SHA512 checksums. · ant.apache.org, 11 Oct 2026
- Reports
- Ivy produces HTML reports about immediate dependencies and graph reports about transitive dependencies and conflicts. · ant.apache.org, 11 Oct 2026
- Repository compatibility
- Ivy supports Maven 2 metadata compatibility and can use Ivy files, Maven 2 POMs, or custom module descriptors. · ant.apache.org, 11 Oct 2026
- Repository support
- Ivy supports Maven 2 metadata and can be configured to use different repositories. · ant.apache.org, 12 Oct 2026
- Runtime and compatibility
- The binary distribution requires at least JRE 1.4 and can be used with Apache Ant 1.6.2 or later. · ant.apache.org, 11 Oct 2026
- Runtime requirement
- The core engine is a single JAR that requires JRE 1.4 or greater. · ant.apache.org, 12 Oct 2026
- Security
- The security page says Apache Ivy 2.6.0 fixed CVE-2026-26032, a medium-severity path traversal vulnerability affecting versions through 2.5.3. · ant.apache.org, 11 Oct 2026
Where Apache Ivy stands on Freedom251
- Package Managers#57 of 93