Specify versions for plugins. #7588
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![copybara-service[bot]](https://avatars.githubusercontent.com/in/44061?s=60&v=4){kind=small}
I'm getting the impression that Maven, rather than having some kind of default like "Maven 3.9.9 uses `maven-install-plugin:3.1.3`," actually just downloads the newest version of every plugin without a specified version. If so, that is making our builds non-hermetic, and I wonder if that sort of behavior could explain why I wasn't sure what change on our part could have caused google/auto#1832 (and _maybe_ even misdiagnosed google/truth#1343, though I haven't investigated any of this). Anyway, I noticed this because of: ``` Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-install-plugin/maven-metadata.xml Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-install-plugin/maven-metadata.xml (895 B at 2.1 kB/s) [WARNING] Ignoring incompatible plugin version 4.0.0-beta-1: The plugin org.apache.maven.plugins:maven-install-plugin:4.0.0-beta-1 requires Maven version 4.0.0-beta-3 [INFO] Latest version of plugin org.apache.maven.plugins:maven-install-plugin failed compatibility check [INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-install-plugin [INFO] Selected plugin org.apache.maven.plugins:maven-install-plugin:3.1.3 Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-deploy-plugin/maven-metadata.xml Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-deploy-plugin/maven-metadata.xml (984 B at 89 kB/s) [WARNING] Ignoring incompatible plugin version 4.0.0-beta-1: The plugin org.apache.maven.plugins:maven-deploy-plugin:4.0.0-beta-1 requires Maven version 4.0.0-beta-3 [INFO] Latest version of plugin org.apache.maven.plugins:maven-deploy-plugin failed compatibility check [INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-deploy-plugin [INFO] Selected plugin org.apache.maven.plugins:maven-deploy-plugin:3.1.3 ``` RELNOTES=n/a PiperOrigin-RevId: 711438220
copybara-service
bot
force-pushed
the
test_711420356
branch
from
90375fa to
c146772
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Specify versions for plugins.
I'm getting the impression that Maven, rather than having some kind of default like "Maven 3.9.9 uses
maven-install-plugin:3.1.3," actually just downloads the newest version of every plugin without a specified version. If so, that is making our builds non-hermetic, and I wonder if that sort of behavior could explain why I wasn't sure what change on our part could have caused google/auto#1832 (and maybe even misdiagnosed google/truth#1343, though I haven't investigated any of this).Anyway, I noticed this because of:
RELNOTES=n/a