Ingo Karkat opened MDEP-934 and commented

Following https://www.sonatype.com/blog/2008/04/how-to-override-a-plugins-dependency-in-maven, I'm overriding two dependencies of the {}editorconfig-maven-plugin{}, like this:

<project>
    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.ec4j.maven</groupId>
                    <artifactId>editorconfig-maven-plugin</artifactId>
                    <dependencies>
                        <dependency>
                            <groupId>org.ec4j.linters</groupId>
                            <artifactId>editorconfig-lint-api</artifactId>
                            <version>2.2.2</version>
                        </dependency>
                        <dependency>
                            <groupId>org.ec4j.linters</groupId>
                            <artifactId>editorconfig-linters</artifactId>
                            <version>2.2.2</version>
                        </dependency>
                    </dependencies>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>
</project>

and it works (i.e. on {}mvn verify{}, the updated dependency (that has a bug fix) is used), but mvn dependency:resolve-plugins still lists the original dependency versions (0.2.1 instead of 2.2.2), which led me to believe that my change somehow isn't working. One main use case of resolve-plugins is troubleshooting like this; it mustn't lie to the user!

[INFO]    org.ec4j.maven:editorconfig-maven-plugin:maven-plugin:0.1.3:runtime
[INFO]       org.ec4j.maven:editorconfig-maven-plugin:jar:0.1.3
[INFO]       org.apache.maven.shared:maven-shared-utils:jar:3.3.4
[INFO]       commons-io:commons-io:jar:2.6
[INFO]       org.ec4j.linters:editorconfig-lint-api:jar:0.2.1
[INFO]       org.ec4j.core:ec4j-core:jar:0.2.1
[INFO]       org.ec4j.linters:editorconfig-linters:jar:0.2.1
[INFO]       org.antlr:antlr4-runtime:jar:4.7

 

 

---

Affects: 3.6.1

Issue Links:

• MDEP-507 dependency:resolve-plugins and dependency:go-offline doesn't respect plugin dependencies from pom.xml
  ("duplicates")