dependabot / dependabot/dependabot-core

Maven Wrapper Support Is Causing Dependabot Failures For Dependencies Not In Maven Central

Open
#15,933 0 comments 0 reactions 0 assignees View on GitHub
L: java:maven T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

Maven

### Package manager version

3.9.0

### Language version

Java

### Manifest location and content before the Dependabot update

https://github.com/spring-cloud/spring-cloud-commons/blob/main/pom.xml

### dependabot.yml content

https://github.com/spring-cloud/spring-cloud-commons/blob/main/.github/dependabot.yml

### Updated dependency

org.apache.maven:apache-maven
from 3.9.0 to 3.9.19

### What you expected to see, versus what you actually saw

No maven dependency behaviors instead I see
```
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[FATAL] Non-resolvable parent POM for org.springframework.cloud:spring-cloud-zookeeper:4.3.5-SNAPSHOT: The following artifacts could not be resolved: org.springframework.cloud:spring-cloud-build:pom:4.3.6-SNAPSHOT (absent): Could not find artifact org.springframework.cloud:spring-cloud-build:pom:4.3.6-SNAPSHOT and 'parent.relativePath' points at no local POM @ line 14, column 10
@
[ERROR] The build could not read 1 project -> [Help 1]
[ERROR]
[ERROR] The project org.springframework.cloud:spring-cloud-zookeeper:4.3.5-SNAPSHOT (dependabot_tmp_dir/pom.xml) has 1 error
[ERROR] Non-resolvable parent POM for org.springframework.cloud:spring-cloud-zookeeper:4.3.5-SNAPSHOT: The following artifacts could not be resolved: org.springframework.cloud:spring-cloud-build:pom:4.3.6-SNAPSHOT (absent): Could not find artifact org.springframework.cloud:spring-cloud-build:pom:4.3.6-SNAPSHOT and 'parent.relativePath' points at no local POM @ line 14, column 10 -> [Help 2]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
```

These SNAPSHOTS live in repo.spring.io not on maven central. The repositories are configured in the POM and should be activated when using the maven wrapper (by activating the `spring` provile)

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

[job-logs.txt](https://github.com/user-attachments/files/31153633/job-logs.txt)

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the Maven manifest at pom.xml, .github/dependabot.yml, and the linked job-logs.txt to understand how the Maven wrapper update is invoked. Trace Maven wrapper support for the spring profile and verify the behavior against the repository's SNAPSHOT dependencies; done means Dependabot can process the update without failing to resolve artifacts hosted in repo.spring.io.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.