apache / apache/maven

Overrides for central repository being ignored during <scope>import</scope> resolution

Open
#11,469 7 comments 0 reactions 0 assignees View on GitHub
bug mvn3
Dominant language
Java
Stars
5.3k
Forks
3.1k
Avg merge
20h 42m
Merged PRs (30d)
297

Description

### Affected version

3.9.11

### Bug description

Initially I posted that as a question in [StackOverflow](https://stackoverflow.com/questions/79824887/maven-ignores-central-repository-overrides-when-scopeimport-scopeing-pom-int), but while I was collecting the evidence, I was more convinced that this is a bug.

Please find below a copy of my SO question, so you don't have to follow the links:

=======

I have the following Maven `settings.xml` to make Maven go to my local Maven Central mirror (this is a standard way recommended by JFrog Artifactory):
```xml



artifactory


central
mvn-libs-release

false

https://artifactory.example.com/artifactory/mvn-libs-release


snapshots
mvn-libs-snapshot

https://artifactory.example.com/artifactory/mvn-libs-snapshot




central
mvn-plugins-release

false

https://artifactory.example.com/artifactory/mvn-plugins-release


snapshots
mvn-plugins-snapshot

https://artifactory.example.com/artifactory/mvn-plugins-snapshot




artifactory

```

And here is my simplest-repro POM, having basically one entry in dependency management and nothing else:
```xml

4.0.0

com.example
untitled
1.0-SNAPSHOT
pom




org.springframework.boot
spring-boot-dependencies
3.5.6
import
pom


```

Then I run `mvn -X -N clean install` and see the following entries:

```
[DEBUG] Creating adapter using nameMapper 'gav' and factory 'rwlock-local'
[DEBUG] Resolving artifact org.springframework.boot:spring-boot-dependencies:pom:3.5.6 from [central (https://artifactory.example.com/artifactory/mvn-libs-release, default, releases), snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots)]
[DEBUG] Resolving artifact org.springframework.boot:spring-boot-dependencies:pom:3.5.6 from [central (https://artifactory.example.com/artifactory/mvn-libs-release, default, releases), snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots)]
[DEBUG] Using transporter HttpTransporter with priority 5.0 for https://artifactory.example.com/artifactory/mvn-libs-release
[DEBUG] Using connector BasicRepositoryConnector with priority 0.0 for https://artifactory.example.com/artifactory/mvn-libs-release with username=kg@example.com, password=***
Downloading from central: https://artifactory.example.com/artifactory/mvn-libs-release/org/springframework/boot/spring-boot-dependencies/3.5.6/spring-boot-dependencies-3.5.6.pom
Progress (1): spring-boot-dependencies-3.5.6.pom (7.6/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (16/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (32/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (49/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (65/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (81/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (96 kB)

Downloaded from central: https://artifactory.example.com/artifactory/mvn-libs-release/org/springframework/boot/spring-boot-dependencies/3.5.6/spring-boot-dependencies-3.5.6.pom (96 kB at 222 kB/s)
[DEBUG] Writing tracking file 'D:\Dev\.m2\repository\org\springframework\boot\spring-boot-dependencies\3.5.6\_remote.repositories'
[DEBUG] Writing tracking file 'D:\Dev\.m2\repository\org\springframework\boot\spring-boot-dependencies\3.5.6\spring-boot-dependencies-3.5.6.pom.lastUpdated'
[DEBUG] Resolving artifact org.apache.activemq:activemq-bom:pom:6.1.7 from [snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots), central (https://repo.maven.apache.org/maven2, default, releases)]
[DEBUG] Resolving artifact org.apache.activemq:activemq-bom:pom:6.1.7 from [snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots), central (https://repo.maven.apache.org/maven2, default, releases)]
[DEBUG] Using transporter HttpTransporter with priority 5.0 for https://artifactory.example.com/artifactory/mvn-libs-snapshot
[DEBUG] Using connector BasicRepositoryConnector with priority 0.0 for https://artifactory.example.com/artifactory/mvn-libs-snapshot
Downloading from snapshots: https://artifactory.example.com/artifactory/mvn-libs-snapshot/org/apache/activemq/activemq-bom/6.1.7/activemq-bom-6.1.7.pom
[DEBUG] Writing tracking file 'D:\Dev\.m2\repository\org\apache\activemq\activemq-bom\6.1.7\activemq-bom-6.1.7.pom.lastUpdated'
[DEBUG] Using transporter HttpTransporter with priority 5.0 for https://repo.maven.apache.org/maven2
[DEBUG] Using connector BasicRepositoryConnector with priority 0.0 for https://repo.maven.apache.org/maven2 with username=kg@example.com, password=*** via proxy.example.com:8080
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-bom/6.1.7/activemq-bom-6.1.7.pom
Progress (1): activemq-bom-6.1.7.pom (799 B)
Progress (1): activemq-bom-6.1.7.pom (1.9 kB)
Progress (1): activemq-bom-6.1.7.pom (7.9 kB)

Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-bom/6.1.7/activemq-bom-6.1.7.pom (7.9 kB at 53 kB/s)
```

As you can see, for some reason, Maven falls back to `https://repo.maven.apache.org/maven2` for no good reason.

Removing the import makes repositories work as expected (even though in a given example there is nothing to download, downloading works as expected for any added dependencies).

I understand that `spring-boot-dependencies` is quite a big POM to import, but I couldn't come with a simpler example. Copying all `` section (which itself has some transitive imports) to my POM did not reproduce the issue. Even `mvn clean install`ing the `spring-boot-dependencies` POM itself does not reproduce the issue.

I cannot see any repositories configuration in `spring-boot-dependencies` (having them there and being a reason for that behavior would be weird but would explain it at least to some extent).

Here is what I see in `mvn help:effective-pom` (no trace of resurrected maven.apache.org either):
```xml



false

central
mvn-libs-release
https://artifactory.example.com/artifactory/mvn-libs-release



true

snapshots
mvn-libs-snapshot
https://artifactory.example.com/artifactory/mvn-libs-snapshot





false

central
mvn-plugins-release
https://artifactory.example.com/artifactory/mvn-plugins-release



true

snapshots
mvn-plugins-snapshot
https://artifactory.example.com/artifactory/mvn-plugins-snapshot


```

I managed to reproduce it on Maven 3.8.9 and 3.9.11.

Is there any explanation and workaround for such a behavior?

Contributor guide

Open the contributing guide

Research direction

Reproduce the behavior with the supplied settings.xml and minimal POM on Maven 3.8.9 or 3.9.11, using mvn -X -N clean install. Start with the debug resolution entries for the imported spring-boot-dependencies BOM and compare them with the effective POM. Done means identifying why the imported dependency causes Maven Central to be used and documenting a verified workaround or fix scope.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.