arturobernalg commented on issue #13146: URL: https://github.com/apache/maven/issues/13146#issuecomment-6096847933
I looked into this on current master and found that the behavior depends on the repository merge mode. With an external dependency POM whose active profile declares `central` with a different URL: - `REQUEST_DOMINANT` (used by `DefaultArtifactDescriptorReader`): the existing central repository wins and the conflicting external repository is dropped. A repository with a unique id is still accepted. - `POM_DOMINANT`: the external `central` declaration replaces the existing one. So the normal artifact descriptor resolution path already prevents the shadowing described here, but does so silently. Adding a generic same-id/different-url warning also looks problematic because many existing POMs redeclare `central` using legacy URLs, which could generate a large number of warnings. For the remaining `POM_DOMINANT` case, making external models recessive would change the existing precedence semantics. Would you prefer this issue to: 1. add a warning for conflicts that are already discarded in the `REQUEST_DOMINANT` path, or 2. change the `POM_DOMINANT` semantics so external models cannot override an existing repository id? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
