See https://issues.apache.org/jira/browse/MNG-4390
AFAIR this never changed in 3.x lineage. Thanks T On Wed, Oct 21, 2026, 23:29 Hans Aikema via users <[email protected]> wrote: > Martin, > > Thorsten is neither mentioning anything regarding repositoryUrl elements, > nor is he talking about pom.xml. > He is talking about the new settings.xml elements > (repositoryOrigins/repositoryOrigin with the server element) that are part > of the security hardening of maven 3.10.0 > https://maven.apache.org/docs/3.10.0/release-notes.html#security-hardening > and voices his surprise that his maven settings.xml was accepted by maven > without complaints although he used elements of the new settings 1.3.0 > schema in a file that stated to be following the settings 1.2.0 schema > > kind regards, > Hans > > > Op 21 okt 2026 om 22:37 heeft Martin Gainty <[email protected]> het > volgende geschreven: > > > > Hi Thorsten > > according to 3.9.6 documentation located at Maven Model – Maven< > https://maven.apache.org/ref/3.9.6/maven-model/maven.html> does not > support attribute called repositoryUrl > > Maven specifies only one of 2 xsds may be used under 3.9.6 > > > > * https://maven.apache.org/xsd/maven-v3_0_0.xsd for Maven 1.1. > > * https://maven.apache.org/xsd/maven-4.0.0.xsd for Maven 2.0. > > > > if we jump forward to 3.10.0 spec located at > > Maven – Maven Model< > https://maven.apache.org/ref/3.10.0/maven-model/maven.html> maven does > not support attribute called repositoryUrl > > specified only one of 2 xsds may be used under 3.10.0 > > > > * https://maven.apache.org/xsd/maven-v3_0_0.xsd for Maven 1.1. > > * https://maven.apache.org/xsd/maven-4.0.0.xsd for Maven 3.0. > > > > Nota Bene: Neither XSD contains your repositoryUrl attribute > > > > How does Maven use repositoryUrl? > > Instead, Maven defines the repository location using the XML element > name <url> nested inside a <repository>, <snapshotRepository>, or <mirror> > tag. > > The two main official Maven XSD files that configure these repository > URLs are: > > > > 1. > > maven-4.0.0.xsd (POM Schema): Used for pom.xml. It validates the <url> > element within project repositories: [1< > https://maven.apache.org/ref/3.9.11/maven-model/maven.html>, 2< > https://jmini.github.io/blog/2016/2016-02-21_maven_repo_and_pom_files.html > >] > > xml > > > > <repositories> > > <repository> > > <id>central</id> > > <url>https://apache.org</url> <!-- Core element --> > > </repository> > > </repositories> > > > > > > Use code with caution. > > > > 1. settings-1.0.0.xsd or settings-1.2.0.xsd (Settings Schema): Used > for settings.xml. It validates the <url> element inside <mirrors> or > profile <repositories>. [1<https://maven.apache.org/settings.html>, 2< > https://www.sonatype.com/maven-complete-reference/settings-details>, 3< > https://maven.apache.org/ref/3.8.9/maven-settings/settings.html>, 4< > https://maven.apache.org/ref/3.0.4/maven-settings/settings.html>] > > > > so your implementation of <repositoryUrl> instead of <repository><url> > used in maven 1.1 or maven 3.0 > > appears to be out of spec with either supporting maven xsd > > M- > > ________________________________ > > From: Thorsten Heit via users > > Sent: Wednesday, October 21, 2026 1:04 PM > > To: Maven Users List > > Cc: Thorsten Heit > > Subject: Maven not validating XML files containing namespace > declarations? > > > > Hi, > > > > recently I upgraded my local Maven installation from 3.9.16 to 3.10.0 > > and got the following warning message at the beginning of a build: > > > > (...) > > [WARNING] Using credentials of server 'local-repo' for repository > > [https://.../libs-release-local]https://.../libs-release-local, > although no repository or mirror with > > this id is declared in settings or on the command line and the server > > declares no <repositoryOrigins>. Declare '[https://...]https://...' in > > <repositoryOrigins> of that server in settings to bind these credentials > > explicitly, or set maven.repository.credentialScope=strict to refuse > > such credential use. > > (...) > > > > Ok, the message is more or less self-explanatory, I added the tag to my > > settings.xml and the warning went away. Great. > > > > Obviously my settings.xml is now an invalid XML file because of the > > following namespace declaration: > > > > > > <?xml version="1.0" encoding="UTF-8"?> > > <settings xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 > > https://maven.apache.org/xsd/settings-1.2.0.xsd"; > > xmlns="http://maven.apache.org/SETTINGS/1.2.0"; > > xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> > > <servers> > > <server> > > <id>local-repo</id> > > <username>...</username> > > <password>...</password> > > <repositoryOrigins> > > <repositoryOrigin>https://...</repositoryOrigin> > > </repositoryOrigins> > > </server> > > ... > > > > The tag itself isn't contained in the 1.2.0 xsd but in 1.3.0. > > > > Is this intentional that Maven doesn't validate the XML file when a > > namespace is declared? Not that it matters much in this special case; I > > just wondered... > > > > This could happen in other places as well such as assembly descriptors, > > extension xml files etc. > > > > > > Regards > > > > Thorsten >
