How does Maven resolve plugin versions?

Question

I'm reading the docs and still confused as to how Maven is deciding which versions of plugins to download.

For example, consider this simple scenario:

1. an empty local repository
2. a default settings.xml
3. run a simple maven command. for example, mvn archetype:generate for the maven-archetype-quickstart as described in the Maven in 5 Minutes doc.

After running the command, the first thing Maven does is download a bunch of plugins.

Some of the plugins Maven is downloading include:

• maven-clean-plugin-2.4.1
• maven-install-plugin-2.3.1
• maven-deploy-plugin-2.5

Why those versions?

The most recent version of these plugins are:

• maven-clean-plugin-2.5
• maven-install-plugin-2.5.1
• maven-deploy-plugin-2.8.1

I looked at the LATEST version metadata for maven-clean-plugin and it's 2.5

It's not that I necessarily want to force Maven to use different versions of these plugins, I just want to understand WHY it's resolving to those versions.

I'm using Apache Maven 3.0.3

Greater

Answer 1

Maven defines 3 lifecycles in META-INF/plexus/components.xml:

1. Default Lifecycle

Default lifecycle are defined without any associated plugin. Plugin bindings for these lifecycles are defined separately for every packaging in META-INF/plexus/default-bindings.xml

e.g. Plugin bindings for jar packaging

<phases>
  <process-resources>
    org.apache.maven.plugins:maven-resources-plugin:2.6:resources
  </process-resources>
  <compile>
    org.apache.maven.plugins:maven-compiler-plugin:2.5.1:compile
  </compile>
  <process-test-resources>
    org.apache.maven.plugins:maven-resources-plugin:2.6:testResources
  </process-test-resources>
  <test-compile>
    org.apache.maven.plugins:maven-compiler-plugin:2.5.1:testCompile
  </test-compile>
  <test>
    org.apache.maven.plugins:maven-surefire-plugin:2.12.4:test
  </test>
  <package>
    org.apache.maven.plugins:maven-jar-plugin:2.4:jar
  </package>
  <install>
    org.apache.maven.plugins:maven-install-plugin:2.4:install
  </install>
  <deploy>
    org.apache.maven.plugins:maven-deploy-plugin:2.7:deploy
  </deploy>
</phases>

2. Clean Lifecycle clean lifecycle is defined directly with its plugin bindings.

<phases>
  <phase>pre-clean</phase>
  <phase>clean</phase>
  <phase>post-clean</phase>
</phases>
<default-phases>
  <clean>
    org.apache.maven.plugins:maven-clean-plugin:2.5:clean
  </clean>
</default-phases>

3. Site Lifecycle Site lifecycle is defined directly with its plugin bindings.

<phases>
  <phase>pre-site</phase>
  <phase>site</phase>
  <phase>post-site</phase>
  <phase>site-deploy</phase>
</phases>
<default-phases>
  <site>
    org.apache.maven.plugins:maven-site-plugin:3.3:site
  </site>
  <site-deploy>
    org.apache.maven.plugins:maven-site-plugin:3.3:deploy
  </site-deploy>
</default-phases>

If you want to override these default plugin version you can do it from command prompt as follows

mvn org.apache.maven.plugins:maven-clean-plugin:2.0:clean

instead of

mvn clean:clean

Inspiratory

when i look in the components.xml for v3.0.3 i do indeed see the version specified for maven-clean-plugin but not for the install and deploy plugins. how do those versions (and other plugins) get resolved? svn.apache.org/repos/asf/maven/maven-3/tags/maven-3.0.3/… – Greater

there's a super pom (parent of all poms) that is shipped within the maven core jars and that one contains the versions for common/core plugins. – Highboy

Versions for install or deploy depend on packaging type and are defined in default-bindings.xml. I have updated my answer accordingly. Refer to this URL for versions of install and deploy svn.apache.org/repos/asf/maven/maven-3/tags/maven-3.0.3/… . Hope this answers your question. – Inspiratory

default-bindings.xml has now been moved to LifecycleMapping providers – Bowling

Answer 2

Every version of Maven binaries has certain versions of plugin versions hardcoded. That's to make a somewhat reproducible build in the cases when user doesn't provide his own version information. Which you are encouraged to do and once you populate <pluginManagement> section with the plugin versions of your choice, the build will start using it.

Highboy

That's what I experienced, too, and it puzzled me for a while where the version that's used comes from (In fact, until I found your answer here. :). Even more since this answer states that Maven takes the latest version that exists in its local repo. Do you have a reference for the behaviour you describe? – Tejeda

can't google anything relevant now but from memory the latest version was taken in some older versions of maven but eventually some core plugins got default versions encoded in the maven release distro so that future releases of plugins don't break older maven distros. – Highboy

But why does the latest version has a hardcoded plugin version that is way older? Maven 3.5.4 uses a maven-clean-plugin from version 2. (It uses 2.5 while 3.1 is out). – Exhortation

@Exhortation I know this is old, but I would think this is to avoid making builds depend on the version of Maven you are using. – Bowling

Answer 3

It becomes quite clear if you use -X option when building your projects. Please, check my answer in another thread: https://mcmap.net/q/350990/-set-plugin-s-version-on-the-command-line-in-maven-2

Gules