[MNG-8408] Provide a simple way to lock plugins

[jira-importer]

Guillaume Nodet opened MNG-8408 and commented

Maven warns if stock plugins do not have a version specified.
We need to provide a simple way to lock those plugins and point users to it in the warning.

A quick way would be to provide a simple mojo in https://github.com/maveniverse/toolbox to get the latest of each plugin which is not locked and add those to the plugin management section of the root pom.

---

No further details from MNG-8408

[jira-importer]

Tamas Cservenak commented

Related goal already exists: https://gist.github.com/cstamas/c1ca825e6c9d987a0f0596ee43629101

[jira-importer]

Tamas Cservenak commented

Another related development maveniverse/toolbox#145

[jira-importer]

Tamas Cservenak commented

Example use case: Starting with empty POM and:

[cstamas@angeleyes test]$ cat pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <groupId>org.apache.maven.samples</groupId>
    <artifactId>empty</artifactId>
    <version>1.0.0-SNAPSHOT</version>

</project>
[cstamas@angeleyes test]$ mvn toolbox:lock-plugin-versions -DapplyToPom
[INFO] Scanning for projects...
[INFO] 
[INFO] --------------------------------------------< org.apache.maven.samples:empty >--------------------------------------------
[INFO] Building empty 1.0.0-SNAPSHOT
[INFO]   from pom.xml
[INFO] ---------------------------------------------------------[ jar ]----------------------------------------------------------
[INFO] 
[INFO] --- toolbox:0.6.1:lock-plugin-versions (default-cli) @ empty ---
[INFO] Checking newest versions of managed plugins (0)
[INFO] Checking newest versions of plugins (8)
[INFO] * org.apache.maven.plugins:maven-clean-plugin:jar:3.2.0 -> 3.4.0
[INFO] * org.apache.maven.plugins:maven-compiler-plugin:jar:3.13.0 is up to date
[INFO] * org.apache.maven.plugins:maven-surefire-plugin:jar:3.2.5 -> 3.5.2
[INFO] * org.apache.maven.plugins:maven-jar-plugin:jar:3.4.1 -> 3.4.2
[INFO] * org.apache.maven.plugins:maven-install-plugin:jar:3.1.1 -> 3.1.3
[INFO] * org.apache.maven.plugins:maven-resources-plugin:jar:3.3.1 is up to date
[INFO] * org.apache.maven.plugins:maven-deploy-plugin:jar:3.1.1 -> 3.1.3
[INFO] * org.apache.maven.plugins:maven-site-plugin:jar:3.12.1 -> 3.21.0
[INFO] --------------------------------------------------------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] --------------------------------------------------------------------------------------------------------------------------
[INFO] Total time:  0.291 s
[INFO] Finished at: 2024-12-20T19:15:57+01:00
[INFO] --------------------------------------------------------------------------------------------------------------------------
[cstamas@angeleyes test]$ cat pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <groupId>org.apache.maven.samples</groupId>
    <artifactId>empty</artifactId>
    <version>1.0.0-SNAPSHOT</version>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>3.5.2</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-install-plugin</artifactId>
                    <version>3.1.3</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-clean-plugin</artifactId>
                    <version>3.4.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-site-plugin</artifactId>
                    <version>3.21.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-jar-plugin</artifactId>
                    <version>3.4.2</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-resources-plugin</artifactId>
                    <version>3.3.1</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-deploy-plugin</artifactId>
                    <version>3.1.3</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.13.0</version>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>

</project>
[cstamas@angeleyes test]$ 

[rupert-madden-abbott]

The problems with the proposed solution are:

1. This is very verbose and I need an additional tool - neither of these is helpful to newcomers.
2. This gets you started but doesn't help with maintenance.

The reason this warning exists is because the plugin versions vary by Maven version. What would be nicer is to be able communicate that intent more closely i.e. "Use the plugin versions for Maven X if undefined".