[MNG-6562] WARN if plugins injected by default lifecycle bindings don't have their version locked in pom.xml or parent

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.6.0
• Fix Version/s: 4.0.0-alpha-2, 4.0.0
• Component/s: Plugins and Lifecycle
• Assignee: Robert Scholte
• Reporter: Herve Boutemy
• Created: 13/Jan/19 18:04
• Updated: 20/Oct/22 08:11
• Resolved: 20/Jun/20 08:20

Description

Currently, when building from a basic pom.xml:

<project>
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.mycompany.app</groupId>
  <artifactId>my-app</artifactId>
  <version>1.0-SNAPSHOT</version>
</project>

many plugins are used, but their version is not locked by the user: the default plugins versions depend on Maven version used, which is not stable over different Maven versions.

Adding a warning for this stability issue will help users know that they need to lock down plugins versions in their pom (or parent), something like:

[WARNING] 
[WARNING] Some problems were encountered while building the effective model for com.mycompany.app:my-app:jar:1.0-SNAPSHOT
[WARNING] Version not locked for default bindings plugins [maven-install-plugin, maven-resources-plugin, maven-surefire-plugin, maven-compiler-plugin, maven-jar-plugin, maven-deploy-plugin, maven-site-plugin], you should define versions in pluginManagement section of your pom.xml or parent
[WARNING] 
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING] 
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.

Issue Links

• breaks: MNG-6960 Use RuntimeInformation instead of reading properties
• is related to: MPOM-215 Create a new parent POM to lock down plugins versions of default lifecycle bindings
• is related to: MNG-5588 Scope import in pluginManagement
• is required by: MNG-6169 Packaging plugin bindings version updates
• is required by: MNG-6548 Lifecycle plugin version upgrades
• links to: GitHub Pull Request #233