[
https://issues.apache.org/jira/browse/MRESOLVER-363?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17726654#comment-17726654
]
Tamas Cservenak commented on MRESOLVER-363:
-------------------------------------------
So, we have several things in play:
Maven - out of the box (when user does not customize anything), the default
update policy for *RELEASE* repositories is *never*. It is exactly due
immutability (of releases), nothing is updated unless you say so.
Have to note two things: we are talking about release repositories and their
use in POMs: you usually "address" a release artifact by G:A:V where V is some
version. The support from Maven2 times where "LATEST" or "RELEASE" was
supported is gone. Hence, Maven when collects project dependencies (actually
this is true for plugins and plugin dependencies) it goes *directly* for
artifact, it does not even download metadata to "discover existing versions".
You are mixing in things with one specific plugin and it's goal: the versions
plugin. Versions plugin allows you to automate (well, get a report of) plugin
updates. But to produce this report, plugins asks resolver to list versions.
And for that, the metadata is used. Use case used by versions plugins is
"discover versions", and that use case does require metadata (that as you saw,
enlists "existing versions"). I have to repeat, "everyday" Maven does NOT use
this metadata at all... easy to check: perform a simple build with empty local
repository, and look into local repository: how many GA level maven metadata
will you find there? (and repeat and emphasize, we talk about release remote
repositories, for snapshots things are a bit different)
Still, plugin runs within maven, that configures resolver (based on user
configuration or defaults).
Hence, we can argue is maven out of the box default configuration sane (it is
cautious at least, for exact reasons you brought up) or not, but one thing
sure: the code works as expected :)
> Maven metadata is not updated in some cases
> -------------------------------------------
>
> Key: MRESOLVER-363
> URL: https://issues.apache.org/jira/browse/MRESOLVER-363
> Project: Maven Resolver
> Issue Type: Bug
> Affects Versions: 1.9.10
> Reporter: Tamas Cservenak
> Assignee: Tamas Cservenak
> Priority: Major
>
> Seems when update check for metadata happens, and:
> * maven-metadata XML is present, but
> * resolver-status.properties is not, OR was created by maven-compat, that
> uses different key for lastUpdated. Effectively the value of lastUpdated is
> not present.
> The update check falsely DO NOT check for update, as it will end up with
> update policy "never" in update policy analyzer.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
