Martin, Thorsten is neither mentioning anything regarding repositoryUrl elements, nor is he talking about pom.xml. He is talking about the new settings.xml elements (repositoryOrigins/repositoryOrigin with the server element) that are part of the security hardening of maven 3.10.0 https://maven.apache.org/docs/3.10.0/release-notes.html#security-hardening and voices his surprise that his maven settings.xml was accepted by maven without complaints although he used elements of the new settings 1.3.0 schema in a file that stated to be following the settings 1.2.0 schema
kind regards, Hans > Op 21 okt 2026 om 22:37 heeft Martin Gainty <[email protected]> het > volgende geschreven: > > Hi Thorsten > according to 3.9.6 documentation located at Maven Model – > Maven<https://maven.apache.org/ref/3.9.6/maven-model/maven.html> does not > support attribute called repositoryUrl > Maven specifies only one of 2 xsds may be used under 3.9.6 > > * https://maven.apache.org/xsd/maven-v3_0_0.xsd for Maven 1.1. > * https://maven.apache.org/xsd/maven-4.0.0.xsd for Maven 2.0. > > if we jump forward to 3.10.0 spec located at > Maven – Maven > Model<https://maven.apache.org/ref/3.10.0/maven-model/maven.html> maven does > not support attribute called repositoryUrl > specified only one of 2 xsds may be used under 3.10.0 > > * https://maven.apache.org/xsd/maven-v3_0_0.xsd for Maven 1.1. > * https://maven.apache.org/xsd/maven-4.0.0.xsd for Maven 3.0. > > Nota Bene: Neither XSD contains your repositoryUrl attribute > > How does Maven use repositoryUrl? > Instead, Maven defines the repository location using the XML element name > <url> nested inside a <repository>, <snapshotRepository>, or <mirror> tag. > The two main official Maven XSD files that configure these repository URLs > are: > > 1. > maven-4.0.0.xsd (POM Schema): Used for pom.xml. It validates the <url> > element within project repositories: > [1<https://maven.apache.org/ref/3.9.11/maven-model/maven.html>, > 2<https://jmini.github.io/blog/2016/2016-02-21_maven_repo_and_pom_files.html>] > xml > > <repositories> > <repository> > <id>central</id> > <url>https://apache.org</url> <!-- Core element --> > </repository> > </repositories> > > > Use code with caution. > > 1. settings-1.0.0.xsd or settings-1.2.0.xsd (Settings Schema): Used for > settings.xml. It validates the <url> element inside <mirrors> or profile > <repositories>. [1<https://maven.apache.org/settings.html>, > 2<https://www.sonatype.com/maven-complete-reference/settings-details>, > 3<https://maven.apache.org/ref/3.8.9/maven-settings/settings.html>, > 4<https://maven.apache.org/ref/3.0.4/maven-settings/settings.html>] > > so your implementation of <repositoryUrl> instead of <repository><url> used > in maven 1.1 or maven 3.0 > appears to be out of spec with either supporting maven xsd > M- > ________________________________ > From: Thorsten Heit via users > Sent: Wednesday, October 21, 2026 1:04 PM > To: Maven Users List > Cc: Thorsten Heit > Subject: Maven not validating XML files containing namespace declarations? > > Hi, > > recently I upgraded my local Maven installation from 3.9.16 to 3.10.0 > and got the following warning message at the beginning of a build: > > (...) > [WARNING] Using credentials of server 'local-repo' for repository > [https://.../libs-release-local]https://.../libs-release-local, although no > repository or mirror with > this id is declared in settings or on the command line and the server > declares no <repositoryOrigins>. Declare '[https://...]https://...' in > <repositoryOrigins> of that server in settings to bind these credentials > explicitly, or set maven.repository.credentialScope=strict to refuse > such credential use. > (...) > > Ok, the message is more or less self-explanatory, I added the tag to my > settings.xml and the warning went away. Great. > > Obviously my settings.xml is now an invalid XML file because of the > following namespace declaration: > > > <?xml version="1.0" encoding="UTF-8"?> > <settings xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 > https://maven.apache.org/xsd/settings-1.2.0.xsd"; > xmlns="http://maven.apache.org/SETTINGS/1.2.0"; > xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> > <servers> > <server> > <id>local-repo</id> > <username>...</username> > <password>...</password> > <repositoryOrigins> > <repositoryOrigin>https://...</repositoryOrigin> > </repositoryOrigins> > </server> > ... > > The tag itself isn't contained in the 1.2.0 xsd but in 1.3.0. > > Is this intentional that Maven doesn't validate the XML file when a > namespace is declared? Not that it matters much in this special case; I > just wondered... > > This could happen in other places as well such as assembly descriptors, > extension xml files etc. > > > Regards > > Thorsten
