gagarski opened a new issue, #11469: URL: https://github.com/apache/maven/issues/11469
### Affected version 3.9.11 ### Bug description Initially I posted that as a question in [StackOverflow](https://stackoverflow.com/questions/79824887/maven-ignores-central-repository-overrides-when-scopeimport-scopeing-pom-int), but while I was collecting the evidence, I was more convinced that this is a bug. Please find below a copy of my SO question, so you don't have to follow the links: ======= I have the following Maven `settings.xml` to make Maven go to my local Maven Central mirror (this is a standard way recommended by JFrog Artifactory): ```xml <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd";> <profiles> <profile> <id>artifactory</id> <repositories> <repository> <id>central</id> <name>mvn-libs-release</name> <snapshots> <enabled>false</enabled> </snapshots> <url>https://artifactory.example.com/artifactory/mvn-libs-release</url> </repository> <repository> <id>snapshots</id> <name>mvn-libs-snapshot</name> <snapshots/> <url>https://artifactory.example.com/artifactory/mvn-libs-snapshot</url> </repository> </repositories> <pluginRepositories> <pluginRepository> <id>central</id> <name>mvn-plugins-release</name> <snapshots> <enabled>false</enabled> </snapshots> <url>https://artifactory.example.com/artifactory/mvn-plugins-release</url> </pluginRepository> <pluginRepository> <id>snapshots</id> <name>mvn-plugins-snapshot</name> <snapshots/> <url>https://artifactory.example.com/artifactory/mvn-plugins-snapshot</url> </pluginRepository> </pluginRepositories> </profile> </profiles> <activeProfiles> <activeProfile>artifactory</activeProfile> </activeProfiles> </settings> ``` And here is my simplest-repro POM, having basically one entry in dependency management and nothing else: ```xml <?xml version="1.0" encoding="UTF-8"?> <project xmlns="http://maven.apache.org/POM/4.0.0"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd";> <modelVersion>4.0.0</modelVersion> <groupId>com.example</groupId> <artifactId>untitled</artifactId> <version>1.0-SNAPSHOT</version> <packaging>pom</packaging> <dependencyManagement> <dependencies> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-dependencies</artifactId> <version>3.5.6</version> <scope>import</scope> <type>pom</type> </dependency> </dependencies> </dependencyManagement> </project> ``` Then I run `mvn -X -N clean install` and see the following entries: ``` [DEBUG] Creating adapter using nameMapper 'gav' and factory 'rwlock-local' [DEBUG] Resolving artifact org.springframework.boot:spring-boot-dependencies:pom:3.5.6 from [central (https://artifactory.example.com/artifactory/mvn-libs-release, default, releases), snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots)] [DEBUG] Resolving artifact org.springframework.boot:spring-boot-dependencies:pom:3.5.6 from [central (https://artifactory.example.com/artifactory/mvn-libs-release, default, releases), snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots)] [DEBUG] Using transporter HttpTransporter with priority 5.0 for https://artifactory.example.com/artifactory/mvn-libs-release [DEBUG] Using connector BasicRepositoryConnector with priority 0.0 for https://artifactory.example.com/artifactory/mvn-libs-release with [email protected], password=*** Downloading from central: https://artifactory.example.com/artifactory/mvn-libs-release/org/springframework/boot/spring-boot-dependencies/3.5.6/spring-boot-dependencies-3.5.6.pom Progress (1): spring-boot-dependencies-3.5.6.pom (7.6/96 kB) Progress (1): spring-boot-dependencies-3.5.6.pom (16/96 kB) Progress (1): spring-boot-dependencies-3.5.6.pom (32/96 kB) Progress (1): spring-boot-dependencies-3.5.6.pom (49/96 kB) Progress (1): spring-boot-dependencies-3.5.6.pom (65/96 kB) Progress (1): spring-boot-dependencies-3.5.6.pom (81/96 kB) Progress (1): spring-boot-dependencies-3.5.6.pom (96 kB) Downloaded from central: https://artifactory.example.com/artifactory/mvn-libs-release/org/springframework/boot/spring-boot-dependencies/3.5.6/spring-boot-dependencies-3.5.6.pom (96 kB at 222 kB/s) [DEBUG] Writing tracking file 'D:\Dev\.m2\repository\org\springframework\boot\spring-boot-dependencies\3.5.6\_remote.repositories' [DEBUG] Writing tracking file 'D:\Dev\.m2\repository\org\springframework\boot\spring-boot-dependencies\3.5.6\spring-boot-dependencies-3.5.6.pom.lastUpdated' [DEBUG] Resolving artifact org.apache.activemq:activemq-bom:pom:6.1.7 from [snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots), central (https://repo.maven.apache.org/maven2, default, releases)] [DEBUG] Resolving artifact org.apache.activemq:activemq-bom:pom:6.1.7 from [snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots), central (https://repo.maven.apache.org/maven2, default, releases)] [DEBUG] Using transporter HttpTransporter with priority 5.0 for https://artifactory.example.com/artifactory/mvn-libs-snapshot [DEBUG] Using connector BasicRepositoryConnector with priority 0.0 for https://artifactory.example.com/artifactory/mvn-libs-snapshot Downloading from snapshots: https://artifactory.example.com/artifactory/mvn-libs-snapshot/org/apache/activemq/activemq-bom/6.1.7/activemq-bom-6.1.7.pom [DEBUG] Writing tracking file 'D:\Dev\.m2\repository\org\apache\activemq\activemq-bom\6.1.7\activemq-bom-6.1.7.pom.lastUpdated' [DEBUG] Using transporter HttpTransporter with priority 5.0 for https://repo.maven.apache.org/maven2 [DEBUG] Using connector BasicRepositoryConnector with priority 0.0 for https://repo.maven.apache.org/maven2 with [email protected], password=*** via proxy.example.com:8080 Downloading from central: https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-bom/6.1.7/activemq-bom-6.1.7.pom Progress (1): activemq-bom-6.1.7.pom (799 B) Progress (1): activemq-bom-6.1.7.pom (1.9 kB) Progress (1): activemq-bom-6.1.7.pom (7.9 kB) Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-bom/6.1.7/activemq-bom-6.1.7.pom (7.9 kB at 53 kB/s) ``` As you can see, for some reason, Maven falls back to `https://repo.maven.apache.org/maven2` for no good reason. Removing the import makes repositories work as expected (even though in a given example there is nothing to download, downloading works as expected for any added dependencies). I understand that `spring-boot-dependencies` is quite a big POM to import, but I couldn't come with a simpler example. Copying all `<dependencyManagement>` section (which itself has some transitive imports) to my POM did not reproduce the issue. Even `mvn clean install`ing the `spring-boot-dependencies` POM itself does not reproduce the issue. I cannot see any repositories configuration in `spring-boot-dependencies` (having them there and being a reason for that behavior would be weird but would explain it at least to some extent). Here is what I see in `mvn help:effective-pom` (no trace of resurrected maven.apache.org either): ```xml <repositories> <repository> <snapshots> <enabled>false</enabled> </snapshots> <id>central</id> <name>mvn-libs-release</name> <url>https://artifactory.example.com/artifactory/mvn-libs-release</url> </repository> <repository> <snapshots> <enabled>true</enabled> </snapshots> <id>snapshots</id> <name>mvn-libs-snapshot</name> <url>https://artifactory.example.com/artifactory/mvn-libs-snapshot</url> </repository> </repositories> <pluginRepositories> <pluginRepository> <snapshots> <enabled>false</enabled> </snapshots> <id>central</id> <name>mvn-plugins-release</name> <url>https://artifactory.example.com/artifactory/mvn-plugins-release</url> </pluginRepository> <pluginRepository> <snapshots> <enabled>true</enabled> </snapshots> <id>snapshots</id> <name>mvn-plugins-snapshot</name> <url>https://artifactory.example.com/artifactory/mvn-plugins-snapshot</url> </pluginRepository> </pluginRepositories> ``` I managed to reproduce it on Maven 3.8.9 and 3.9.11. Is there any explanation and workaround for such a behavior? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
