dhruv9b commented on PR #1024: URL: https://github.com/apache/maven-enforcer/pull/1024#issuecomment-5645771568
> I'm confused for following reasons: > > * as also noted in [RequireSameVersion failed even with defined versions of failsafe,surefire,surefire-report-plugin #916 (comment)](https://github.com/apache/maven-enforcer/issues/916#issuecomment-3146433534) - `project.getReportArtifacts()` - returns plugins w/o version if there is none specified in `<reporting>` section (exactly this causes [Incorrect (overzealous) version of [managed] reporting plugin being verified s4u/pgpverify-maven-plugin#720](https://github.com/s4u/pgpverify-maven-plugin/issues/720) to use `RELEASE`/the latest, which is not the same as the one used in `<pluginManagement>`) > * [Configuring_Reporting_Plugins](https://maven.apache.org/guides/mini/guide-configuring-plugins.html#Configuring_Reporting_Plugins) says to provide explicit version in `<reporting>` > * the actual behavior of Maven itself is indeed to: > > > Maven allows the reporting plugin version to be resolved from when it is not specified in . > > Can you link to some documentation that support: > > > Maven allows the reporting plugin version to be resolved from when it is not specified in > > ? Thanks for pointing this out. I’m still learning the Maven reporting/plugin resolution behavior, so I may be misunderstanding part of it. I found the official Maven Model documentation for `ReportPlugin#getVersion()`, which states that starting with Maven 3, if no version is defined explicitly, Maven searches for the version in `build/plugins` and then `build/pluginManagement`: https://maven.apache.org/ref/3.9.15/apidocs/org/apache/maven/model/ReportPlugin.html The Maven Model reference documents the same behavior for the `<reporting><plugins><plugin><version>` element: https://maven.apache.org/ref/3.9.15/maven-model/maven.html So my current understanding is that the version can be resolved from `build/pluginManagement` even when it is not explicitly specified under `<reporting>`. In the #916 reproducer, the report plugin is intentionally left without a version under `<reporting>`, while its version is managed under `<build><pluginManagement>`. The issue appears to be that `project.getReportArtifacts()` can still expose that report artifact with `RELEASE`, which is what causes the version comparison to differ from the corresponding build plugin. I’ll review this behavior further to make sure I’m understanding Maven’s resolution correctly. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
