versions: Versions Maven Plugin not showing latest plugins available with ignores.

On Windows 10 with Maven 3.9.1 I upgraded to org.codehaus.mojo:versions-maven-plugin:2.15.0.

<plugin>
  <groupId>org.codehaus.mojo</groupId>
  <artifactId>versions-maven-plugin</artifactId>
  <version>2.15.0</version>
</plugin>

I wanted to see what plugins were out of date, so I ran:

mvn versions:display-plugin-updates

It shows this:

[INFO] The following plugin updates are available:
[INFO]   maven-failsafe-plugin .......................... 2.22.2 -> 3.0.0-M7
[INFO]   maven-release-plugin ............................ 2.5.3 -> 3.0.0-M6
[INFO]   maven-site-plugin .............................. 3.12.1 -> 4.0.0-M3
[INFO]   maven-surefire-plugin .......................... 2.22.2 -> 3.0.0-M7
[INFO]   org.springframework.boot:spring-boot-maven-plugin .. 2.7.3 -> 3.0.5

So I added ignores for milestone releases as discussed in #684 and originally in #258:

<plugin>
  <groupId>org.codehaus.mojo</groupId>
  <artifactId>versions-maven-plugin</artifactId>
  <version>2.15.0</version>
  <configuration>
    <ruleSet>
      <ignoreVersions>
        <ignoreVersion><type>regex</type><version>.*-SNAPSHOT</version></ignoreVersion>
        <ignoreVersion><type>regex</type><version>.*-alpha(?:-?\d+)?</version></ignoreVersion>
        <ignoreVersion><type>regex</type><version>.*-beta(?:-?\d+)?</version></ignoreVersion>
        <ignoreVersion><type>regex</type><version>.*-M(?:-?\d+)?</version></ignoreVersion>
        <ignoreVersion><type>regex</type><version>.*-RC(?:-?\d+)?</version></ignoreVersion>
        <ignoreVersion><type>regex</type><version>.*-pfd(?:-?\d+)?</version></ignoreVersion>
      </ignoreVersions>
    </ruleSet>
  </configuration>
</plugin>

Now when I run mvn versions:display-plugin-updates it gives me:

[INFO] No plugins require a newer version of Maven than specified by the pom.

This is wrong on several counts. org.apache.maven.plugins:maven-failsafe-plugin for example has v3.0.0 and 3.1.0 available—two versions released after the current version.

And the bug apparently has nothing to do with ignoring the *-M* versions, because it even skipped Spring Boot Maven Plugin, which is currently at v3.1.0.

This would appear critically broken, in that it does not show new versions, which is the essential function of this goal.

Or did I get the regular expressions wrong somehow? (I think they can be simplified a bit; I was starting from those in a Stack Overflow answer. But in any case I don’t see how these regular expressions would be hiding versions in the form 3.0.5.)

About this issue

Original URL
State: closed
Created a year ago
Comments: 108 (21 by maintainers)

Commits related to this issue

JAVA-241: Updated Versions Maven Plugins to fix problem with stale updates. See [#959](https://github.com/mojohaus/versions/issues/959). See [MRESOLVER-363](https://issues.apache.org/jira/browse/MRES... — committed to globalmentor/globalmentor-root by garretwilson a year ago

Most upvoted comments

Thank you for all your work on this, @cstamas ! It’s so good to know we’re getting somewhere. I had put some work on hold to help get this resolved, as I didn’t want to force everything to update until we knew the source of the problem.

@ajarmoniuk , thanks for your input and steering me in the right direction, and letting us hijack this ticket for a bit.

Created https://issues.apache.org/jira/browse/MRESOLVER-363 This is a resolver bug, nothing to do with versions plugin. So if you agree, please close this issue.

I’ll go continue my testing of the new Versions Maven Plugin regex ignore version feature, and if that is working, I’ll note that and close this ticket. Further discussion on this bug can happen at MRESOLVER-363.

Thanks again, and I hope you have a good, restful night @cstamas .

garretwilson on May 25, 2023

Regarding Maven warnings in 3.9.2 – yeah that’s a kinda passive-aggressive way of Maven devs’ of getting users to chase plugin maintainers to fix their dependencies. The one in versions-maven-plugin has already been done and will be fixed 2.16.0. Plenty of other plugins will still suffer from this and it will cause people relying on warnings from their CI/CD some hassle.

ajarmoniuk on May 21, 2023

Please look - https://github.com/mojohaus/versions/pull/965#issuecomment-1564372249 And my way to testing - https://github.com/mojohaus/versions/pull/965#issuecomment-1564400340

So I assume the #957 - will fix problem with missing or wrong property in resolver-status.properties

slawekjaranowski on May 30, 2023

Awesome work! Congrats on getting to the bottom of it!

ajarmoniuk on May 26, 2023

full session https://gist.github.com/cstamas/f12f15ecc399022be2f2957a16fc0e11

step1: https://gist.github.com/cstamas/f12f15ecc399022be2f2957a16fc0e11#file-gistfile1-txt-L1 – full build with empty local repo (snipped out the many screens of downloads) outcome: correct https://gist.github.com/cstamas/f12f15ecc399022be2f2957a16fc0e11#file-gistfile1-txt-L20

step2: https://gist.github.com/cstamas/f12f15ecc399022be2f2957a16fc0e11#file-gistfile1-txt-L54 Showing the contents of directories

step3: https://gist.github.com/cstamas/f12f15ecc399022be2f2957a16fc0e11#file-gistfile1-txt-L71 edited XML set content from here https://github.com/mojohaus/versions/issues/959#issuecomment-1563479777

step4: https://gist.github.com/cstamas/f12f15ecc399022be2f2957a16fc0e11#file-gistfile1-txt-L72 deleting properties file

step5: https://gist.github.com/cstamas/f12f15ecc399022be2f2957a16fc0e11#file-gistfile1-txt-L73 rinse repeat, invoke maven

outcome: https://gist.github.com/cstamas/f12f15ecc399022be2f2957a16fc0e11#file-gistfile1-txt-L93 NO update for launch4j-maven-plugin reported.

🍺

cstamas on May 25, 2023

@garretwilson if no other idea, please reproduce whole DEBUG log (from beginning to end) where you had these lines:

[DEBUG] Checking com.akathist.maven.plugins.launch4j:launch4j-maven-plugin for updates newer than 2.1.3
[DEBUG] Determining update check for artifact com.akathist.maven.plugins.launch4j:launch4j-maven-plugin (C:\Users\user\.m2\repository\com\akathist\maven\plugins\launch4j\launch4j-maven-plugin\maven-metadata-central.xml) from central (https://repo.maven.apache.org/maven2)
[DEBUG] Searching for central.maven-metadata-central.xml.lastUpdated in resolution tracking file.
[DEBUG] Reading resolution-state from: C:\Users\user\.m2\repository\com\akathist\maven\plugins\launch4j\launch4j-maven-plugin\resolver-status.properties
[DEBUG] [com.akathist.maven.plugins.launch4j:launch4j-maven-plugin].version=2.1.3

And send it to me or anyone on this issue even in private (you have our emails from Maven ML) or if nothing special in contents, just attach it as gist.

cstamas on May 25, 2023

@ajarmoniuk I did check it and @slawekjaranowski also confirmed… so I am now more inclined that something else in that build triggered the legacy code, that left local repo in state that resolver assumed “no update needed”.

Given we all tried to reproduce Garret’s problem (and failed to do so), I’d really like to see a reproducer. At the same time I am almost certain, it is impossible to produce one. As this very much can be not only “one build” (like a simple reproducer), but the fact that his local repo is accessed by multiple tools,

cstamas on May 25, 2023

Ah, right. I had done that earlier, but then ignored the rest of the output because I got sidetracked by the “Skipped remote request …” message. But I’m not even sure that’s relevant—that may (or may not) be about metadata for already-downloaded artifacts.

In any case (focusing on com.akathist.maven.plugins.launch4j:launch4j-maven-plugin because that (correctly) shows up for you but doesn’t even appear for me, and has nothing to do with versions ignore), here is the relevant output:

[DEBUG] Checking com.akathist.maven.plugins.launch4j:launch4j-maven-plugin for updates newer than 2.1.3
[DEBUG] Determining update check for artifact com.akathist.maven.plugins.launch4j:launch4j-maven-plugin (C:\Users\user\.m2\repository\com\akathist\maven\plugins\launch4j\launch4j-maven-plugin\maven-metadata-central.xml) from central (https://repo.maven.apache.org/maven2)
[DEBUG] Searching for central.maven-metadata-central.xml.lastUpdated in resolution tracking file.
[DEBUG] Reading resolution-state from: C:\Users\user\.m2\repository\com\akathist\maven\plugins\launch4j\launch4j-maven-plugin\resolver-status.properties
[DEBUG] [com.akathist.maven.plugins.launch4j:launch4j-maven-plugin].version=2.1.3
[DEBUG] [com.akathist.maven.plugins.launch4j:launch4j-maven-plugin].artifactVersion=2.1.2
[DEBUG] [com.akathist.maven.plugins.launch4j:launch4j-maven-plugin].effectiveVersion=2.1.3
[DEBUG] [com.akathist.maven.plugins.launch4j:launch4j-maven-plugin].specified=true

garretwilson on May 24, 2023

-X or --debug

ajarmoniuk on May 24, 2023