[MNG-3358] Require explicit plugin versions

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Component/s: Plugins and Lifecycle
• Assignee: Unassigned
• Reporter: Paul Gier
• Created: 10/Jan/08 14:00
• Updated: 30/Dec/09 18:46
• Resolved: 30/Dec/09 18:46

Description

Currently plugin versions are not required in the pom which causes maven to use the latest version of each plugin to be used when building a project. The problem with this system is that builds can break (without any change to the project itself) if a new version of a plugin is released. This can cause confusion among developers because the build appears to break for no reason. It also makes reproducing old builds to be more difficult because a newer version of a plugin could cause some aspect of the build to be different than when it was originally released.

SUREFIRE-61 is one example of where this happened. When surefire 2.3.1 was released, it affected the testing of some builds because the classpath ordering changed.

My suggestion for fixing this is to require a version for all plugins. This is already a best practice among many maven users, but it is not enforced by maven itself. For the default lifecycle plugins (compiler plugin, surefire plugin, etc.) maven should tie it's version to specific default versions of the plugins. These could then be overridden when necessary.

This change probably belongs in 2.1 since it is too big a change for 2.0.9.

Issue Links

• is related to: MNG-1968 allow disabling of plugin version discovery
• is related to: MNG-3395 Default core plugin versions in the superpom.
• is superceded by: MNG-4173 Remove automatic version resolution for POM plugins