dependabot / dependabot/dependabot-core
Maven Wrapper Support Is Causing Dependabot Failures For Dependencies Not In Maven Central
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
Maven
### Package manager version
3.9.0
### Language version
Java
### Manifest location and content before the Dependabot update
https://github.com/spring-cloud/spring-cloud-commons/blob/main/pom.xml
### dependabot.yml content
https://github.com/spring-cloud/spring-cloud-commons/blob/main/.github/dependabot.yml
### Updated dependency
org.apache.maven:apache-maven
from 3.9.0 to 3.9.19
### What you expected to see, versus what you actually saw
No maven dependency behaviors instead I see
```
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[FATAL] Non-resolvable parent POM for org.springframework.cloud:spring-cloud-zookeeper:4.3.5-SNAPSHOT: The following artifacts could not be resolved: org.springframework.cloud:spring-cloud-build:pom:4.3.6-SNAPSHOT (absent): Could not find artifact org.springframework.cloud:spring-cloud-build:pom:4.3.6-SNAPSHOT and 'parent.relativePath' points at no local POM @ line 14, column 10
@
[ERROR] The build could not read 1 project -> [Help 1]
[ERROR]
[ERROR] The project org.springframework.cloud:spring-cloud-zookeeper:4.3.5-SNAPSHOT (dependabot_tmp_dir/pom.xml) has 1 error
[ERROR] Non-resolvable parent POM for org.springframework.cloud:spring-cloud-zookeeper:4.3.5-SNAPSHOT: The following artifacts could not be resolved: org.springframework.cloud:spring-cloud-build:pom:4.3.6-SNAPSHOT (absent): Could not find artifact org.springframework.cloud:spring-cloud-build:pom:4.3.6-SNAPSHOT and 'parent.relativePath' points at no local POM @ line 14, column 10 -> [Help 2]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
```
These SNAPSHOTS live in repo.spring.io not on maven central. The repositories are configured in the POM and should be activated when using the maven wrapper (by activating the `spring` provile)
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
[job-logs.txt](https://github.com/user-attachments/files/31153633/job-logs.txt)
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Start by reviewing the Maven manifest at pom.xml, .github/dependabot.yml, and the linked job-logs.txt to understand how the Maven wrapper update is invoked. Trace Maven wrapper support for the spring profile and verify the behavior against the repository's SNAPSHOT dependencies; done means Dependabot can process the update without failing to resolve artifacts hosted in repo.spring.io.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100