if he had implemented pom,xml his namespace declaration would either validate/not_validate xmlns as follows
* While Maven itself ignores xmlns validation during its standard build process, IDEs (like IntelliJ or Eclipse) and external XML tools rely on xmlns and xsi:schemaLocation to provide code completion, syntax highlighting, and XML Schema Definition (XSD) validation. [1<https://maven.apache.org/plugins/maven-changes-plugin/using-changes-xsd.html>, 2<https://stackoverflow.com/questions/25996084/pom-xml-namespace-necessary>] * Explicit XML Validation: If you want Maven to actively validate XML files against a schema, you must use a plugin such as the XML Maven Plugin<https://www.mojohaus.org/xml-maven-plugin/validate-mojo.html> (org.codehaus.mojo:xml-maven-plugin). [1<https://www.mojohaus.org/xml-maven-plugin/validate-mojo.html>, 2<https://www.mojohaus.org/xml-maven-plugin/validation.html>] The implementation of xml_maven_plugin for validation would of course would need to happen within pom.xml and cannot be executed from settings.xml Back to repository locations (which is important!) <!-- Define custom remote repositories --> <repositories> <repository> <id>my-custom-repo</id> <name>My Custom Repository</name> <url>https://myserver/repo</url> </repository> </repositories> Regards M- ________________________________ From: Hans Aikema via users <[email protected]> Sent: Wednesday, October 21, 2026 5:28 PM To: Maven Users List <[email protected]> Cc: Maven Users List <[email protected]>; Hans Aikema <[email protected]> Subject: Re: Maven not validating XML files containing namespace declarations? Martin, Thorsten is neither mentioning anything regarding repositoryUrl elements, nor is he talking about pom.xml. He is talking about the new settings.xml elements (repositoryOrigins/repositoryOrigin with the server element) that are part of the security hardening of maven 3.10.0 https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fdocs%2F3.10.0%2Frelease-notes.html%23security-hardening&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479183474%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=pIiuamDMvWcPWGgHmJuhe9QNkwlgv%2BLA4LWtkNF5GPA%3D&reserved=0<https://maven.apache.org/docs/3.10.0/release-notes.html#security-hardening> and voices his surprise that his maven settings.xml was accepted by maven without complaints although he used elements of the new settings 1.3.0 schema in a file that stated to be following the settings 1.2.0 schema kind regards, Hans > Op 21 okt 2026 om 22:37 heeft Martin Gainty <[email protected]> het > volgende geschreven: > > Hi Thorsten > according to 3.9.6 documentation located at Maven Model – > Maven<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fref%2F3.9.6%2Fmaven-model%2Fmaven.html&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479215150%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=nLoNXor%2FZkKn2ZDP1Twzj8KkvmIJCOehhh236vq5zIE%3D&reserved=0<https://maven.apache.org/ref/3.9.6/maven-model/maven.html>> > does not support attribute called repositoryUrl > Maven specifies only one of 2 xsds may be used under 3.9.6 > > * > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fxsd%2Fmaven-v3_0_0.xsd&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479244391%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=IEijO%2BwdDoz0sCgpLXzC8rh6CO9LNK%2BpSCWx54Ecl68%3D&reserved=0<https://maven.apache.org/xsd/maven-v3_0_0.xsd> > for Maven 1.1. > * > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fxsd%2Fmaven-4.0.0.xsd&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479266403%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=muyyJ%2BBp%2F2Drw1kShMTZVLzYZBVMuocFswCjjyD6%2B6g%3D&reserved=0<https://maven.apache.org/xsd/maven-4.0.0.xsd> > for Maven 2.0. > > if we jump forward to 3.10.0 spec located at > Maven – Maven > Model<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fref%2F3.10.0%2Fmaven-model%2Fmaven.html&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479287382%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=cW7NII23dpdns5Ysitr%2Fkkyg7Pv4nrNkZD7kLvql73w%3D&reserved=0<https://maven.apache.org/ref/3.10.0/maven-model/maven.html>> > maven does not support attribute called repositoryUrl > specified only one of 2 xsds may be used under 3.10.0 > > * > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fxsd%2Fmaven-v3_0_0.xsd&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479308017%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=CzlKIMjVYUcv374qjv%2BRKdylsxvV6uo0XKSZaxWUnvs%3D&reserved=0<https://maven.apache.org/xsd/maven-v3_0_0.xsd> > for Maven 1.1. > * > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fxsd%2Fmaven-4.0.0.xsd&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479328350%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=nD5t7IlgT09grrrulnEINjy5Rz399R6PEadt2wcJ8j4%3D&reserved=0<https://maven.apache.org/xsd/maven-4.0.0.xsd> > for Maven 3.0. > > Nota Bene: Neither XSD contains your repositoryUrl attribute > > How does Maven use repositoryUrl? > Instead, Maven defines the repository location using the XML element name > <url> nested inside a <repository>, <snapshotRepository>, or <mirror> tag. > The two main official Maven XSD files that configure these repository URLs > are: > > 1. > maven-4.0.0.xsd (POM Schema): Used for pom.xml. It validates the <url> > element within project repositories: > [1<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fref%2F3.9.11%2Fmaven-model%2Fmaven.html&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479348787%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=xC0lzcm21ajzJ0e%2BRHKiVDG9rVs0N48EoDUShEU18Js%3D&reserved=0>, > > 2<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fjmini.github.io%2Fblog%2F2016%2F2016-02-21_maven_repo_and_pom_files.html&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479368518%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=z9pfqUNgCGQ8ABvDX8lowMdCcBD1y2X%2B%2F%2FGk0kkx9Vg%3D&reserved=0<https://jmini.github.io/blog/2016/2016-02-21_maven_repo_and_pom_files.html>>] > xml > > <repositories> > <repository> > <id>central</id> > > <url>https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapache.org%2F&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479391925%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=2KBffJPQ%2BNPSn%2BbhCBqvdJQTxUR%2FMhjCRipkzCaovQk%3D&reserved=0</url> > <!-- Core element --> > </repository> > </repositories> > > > Use code with caution. > > 1. settings-1.0.0.xsd or settings-1.2.0.xsd (Settings Schema): Used for > settings.xml. It validates the <url> element inside <mirrors> or profile > <repositories>. > [1<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fsettings.html&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479413399%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=Nir7LFaZiov2qhyNAJ%2FGnkGPsr5MZYui2Xdj0sPI7qc%3D&reserved=0>, > > 2<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.sonatype.com%2Fmaven-complete-reference%2Fsettings-details&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479432799%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=pjMifMCFl6F%2BrXzKmkR3KAly5qyZvW2TBZ%2BC%2FQGM6Sk%3D&reserved=0<https://www.sonatype.com/maven-complete-reference/settings-details>>, > > 3<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fref%2F3.8.9%2Fmaven-settings%2Fsettings.html&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479451737%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=NwGXJ%2B90eOtVMlTHYKJW%2FXh%2FWioPGie3uUvbCvalwwc%3D&reserved=0<https://maven.apache.org/ref/3.8.9/maven-settings/settings.html>>, > > 4<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fref%2F3.0.4%2Fmaven-settings%2Fsettings.html&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479472106%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=lSGoNKyCoNOursfZVgh%2Bywpa5cfpAydl%2FT%2FFPp05Q5k%3D&reserved=0<https://maven.apache.org/ref/3.0.4/maven-settings/settings.html>>] > > so your implementation of <repositoryUrl> instead of <repository><url> used > in maven 1.1 or maven 3.0 > appears to be out of spec with either supporting maven xsd > M- > ________________________________ > From: Thorsten Heit via users > Sent: Wednesday, October 21, 2026 1:04 PM > To: Maven Users List > Cc: Thorsten Heit > Subject: Maven not validating XML files containing namespace declarations? > > Hi, > > recently I upgraded my local Maven installation from 3.9.16 to 3.10.0 > and got the following warning message at the beginning of a build: > > (...) > [WARNING] Using credentials of server 'local-repo' for repository > [[https://.../libs-release-local]https://.../libs-release-local]https://.../libs-release-local, > although no repository or mirror with > this id is declared in settings or on the command line and the server > declares no <repositoryOrigins>. Declare > '[[https://...]https://...]https://...]https://...' in > <repositoryOrigins> of that server in settings to bind these credentials > explicitly, or set maven.repository.credentialScope=strict to refuse > such credential use. > (...) > > Ok, the message is more or less self-explanatory, I added the tag to my > settings.xml and the warning went away. Great. > > Obviously my settings.xml is now an invalid XML file because of the > following namespace declaration: > > > <?xml version="1.0" encoding="UTF-8"?> > <settings > xsi:schemaLocation="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fmaven.apache.org%2FSETTINGS%2F1.2.0&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479491299%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=FS8qucui9C10DNr6ZCBay50jnEs%2BOdXzKzE8sG0EO3I%3D&reserved=0 > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaven.apache.org%2Fxsd%2Fsettings-1.2.0.xsd&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479511403%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=IzK1KPkzLOeoswcVsG74bbcumqet5K3dr6DT7NKBdBA%3D&reserved=0";<https://maven.apache.org/xsd/settings-1.2.0.xsd> > xmlns="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fmaven.apache.org%2FSETTINGS%2F1.2.0&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479530042%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=UuAANgIGZ2X9K3MIne8yJgfDlH6zYn%2F6uaFIDyULR9Q%3D&reserved=0<http://maven.apache.org/SETTINGS/1.2.0>" > xmlns:xsi="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2F2001%2FXMLSchema-instance&data=05%7C02%7C%7C3c7e5303ddcd4193d79408df2fba552d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C639282149479554669%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=oqa6lecFIsIc2N0Cc5%2FCjmhqA98PVcv0O7SzyazOLaQ%3D&reserved=0<http://www.w3.org/2001/XMLSchema-instance>"> > <servers> > <server> > <id>local-repo</id> > <username>...</username> > <password>...</password> > <repositoryOrigins> > <repositoryOrigin>https://...</repositoryOrigin> > </repositoryOrigins> > </server> > ... > > The tag itself isn't contained in the 1.2.0 xsd but in 1.3.0. > > Is this intentional that Maven doesn't validate the XML file when a > namespace is declared? Not that it matters much in this special case; I > just wondered... > > This could happen in other places as well such as assembly descriptors, > extension xml files etc. > > > Regards > > Thorsten
