[I] `--ignore-transitive-repositories` does not ignore repositories with unresolved properties from transitive dependencies [maven]

["gnodet (via GitHub)" <gi...@apache.org>]

gnodet opened a new issue, #11356:
URL: https://github.com/apache/maven/issues/11356

   ## Description
   
   The `--ignore-transitive-repositories` flag does not prevent Maven 4 from failing when transitive dependencies define repositories with unresolved properties. This defeats the purpose of the flag, which should allow builds to proceed by ignoring problematic repository definitions from transitive dependencies.
   
   ## Environment
   
   - **Maven Version**: 4.0.0-rc-4 and 4.0.0-SNAPSHOT (20251029.072531-121)
   - **Java Version**: 21.0.9 (Eclipse Adoptium)
   - **OS**: Linux
   
   ## Steps to Reproduce
   
   1. Create a minimal Maven project that depends on `io.debezium:debezium-connector-db2:3.3.1.Final`
   2. Add `.mvn/maven.config` with `--ignore-transitive-repositories`
   3. Run `mvn clean compile`
   
   ### Minimal Reproducer
   
   **pom.xml:**
   ```xml
   <?xml version="1.0" encoding="UTF-8"?>
   <project xmlns="http://maven.apache.org/POM/4.0.0" 
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
            xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
       <modelVersion>4.0.0</modelVersion>
   
       <groupId>org.apache.maven.reproducer</groupId>
       <artifactId>reproducer-debezium</artifactId>
       <version>1.0-SNAPSHOT</version>
       <packaging>jar</packaging>
   
       <properties>
           <maven.compiler.source>11</maven.compiler.source>
           <maven.compiler.target>11</maven.compiler.target>
           <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
           <debezium-version>3.3.1.Final</debezium-version>
       </properties>
   
       <dependencies>
           <dependency>
               <groupId>io.debezium</groupId>
               <artifactId>debezium-connector-db2</artifactId>
               <version>${debezium-version}</version>
           </dependency>
       </dependencies>
   </project>
   ```
   
   **.mvn/maven.config:**
   ```
   --ignore-transitive-repositories
   ```
   
   ## Expected Behavior
   
   With `--ignore-transitive-repositories` enabled, Maven should ignore repository definitions from transitive dependencies (including those with unresolved properties) and only use repositories defined in the current project and settings.xml. The build should succeed.
   
   ## Actual Behavior
   
   ### Maven 4.0.0-rc-4
   
   ```
   [ERROR] Failed to execute goal on project reproducer-debezium: Could not collect dependencies for project org.apache.maven.reproducer:reproducer-debezium:jar:1.0-SNAPSHOT
   [ERROR] java.lang.IllegalArgumentException: Invalid Version Range Request: io.debezium:debezium-parent:pom:3.3.1.Final < [central (https://repo.maven.apache.org/maven2, default, releases), central-snapshots (${publish.snapshot.url}, default, releases+snapshots)]
   [ERROR] 	Caused by: Invalid Version Range Request: io.debezium:debezium-parent:pom:3.3.1.Final < [central (https://repo.maven.apache.org/maven2, default, releases), central-snapshots (${publish.snapshot.url}, default, releases+snapshots)]: Failed to collect dependencies at io.debezium:debezium-connector-db2:jar:3.3.1.Final
   ```
   
   ### Maven 4.0.0-SNAPSHOT (20251029.072531-121)
   
   ```
   [ERROR] Failed to execute goal on project reproducer-debezium: Could not collect dependencies for project org.apache.maven.reproducer:reproducer-debezium:jar:1.0-SNAPSHOT
   [ERROR] java.lang.IllegalArgumentException: Invalid RemoteRepositories: [central (https://repo.maven.apache.org/maven2, default, releases), central-snapshots (${publish.snapshot.url}, default, releases+snapshots)]
   [ERROR] 	Caused by: Invalid RemoteRepositories: [central (https://repo.maven.apache.org/maven2, default, releases), central-snapshots (${publish.snapshot.url}, default, releases+snapshots)]: Failed to collect dependencies at io.debezium:debezium-connector-db2:jar:3.3.1.Final
   ```
   
   The build fails even with `--ignore-transitive-repositories` enabled.
   
   ## Root Cause
   
   The `debezium-build-parent` POM defines a repository with an unresolved property:
   
   ```xml
   <properties>
       <publish.snapshot.url>https://central.sonatype.com/repository/maven-snapshots/</publish.snapshot.url>
   </properties>
   
   <distributionManagement>
     <snapshotRepository>
       <id>central-snapshots</id>
       <name>Maven Central Snapshots</name>
       <url>${publish.snapshot.url}</url>
     </snapshotRepository>
   </distributionManagement>
   ```
   
   Maven 4 attempts to process this repository definition before the `--ignore-transitive-repositories` flag can take effect, causing the build to fail.
   
   ## Analysis
   
   The `--ignore-transitive-repositories` flag should prevent Maven from:
   1. Processing repository definitions from transitive dependencies
   2. Failing due to invalid/unresolved repository URLs in transitive dependencies
   
   Currently, it appears that Maven validates repository definitions from transitive dependencies before applying the ignore logic, which defeats the purpose of the flag.
   
   ## Impact
   
   - Blocks building Apache Camel with Maven 4
   - Prevents users from working around repository definition issues in third-party dependencies
   - Makes `--ignore-transitive-repositories` less useful than intended
   
   ## Suggested Fix
   
   The `--ignore-transitive-repositories` flag should be applied earlier in the dependency resolution process, before repository validation occurs. This would allow Maven to skip processing (and validating) repository definitions from transitive dependencies entirely.
   
   ## Workaround
   
   None found. The only workaround is to use Maven 3.x.
   
   ## Related Issues
   
   - #11355 - Maven 4 fails to resolve properties in repository URLs from transitive dependencies
   
   This issue is related but distinct: #11355 is about the property resolution bug itself, while this issue is about `--ignore-transitive-repositories` not working as expected to bypass such problems.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] `--ignore-transitive-repositories` does not ignore repositories with unresolved properties from transitive dependencies [maven]

["gnodet (via GitHub)" <gi...@apache.org>]

gnodet closed issue #11356: `--ignore-transitive-repositories` does not ignore repositories with unresolved properties from transitive dependencies
URL: https://github.com/apache/maven/issues/11356


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org