use-releases not updating dependencies from internal repository

[oebeledrijfhout]

I have a project with a dependency on another internal project in the pom.xml:

<dependencies>
  <dependency>
    <groupId>com.foomedia</groupId>
    <artifactId>bar-utils</artifactId>
    <version>1.1.33-SNAPSHOT</version>
  </dependency>
</dependencies>

and a custom repository from which it is resolved:

<repositories>
   <repository>
      <id>gitlab-maven</id>
      <url>https://gitlab.com/api/v4/groups/xxxxxxxxxx/-/packages/maven</url>
   </repository>
</repositories>

and the dependency can be resolved:

drijfhout@WS01:~/workspacet$ mvn dependency:get -Dartifact=com.foomedia:bar-utils:1.1.33
[INFO] Scanning for projects...
[INFO]
[INFO] ----------------------< com.rdmedia:baz-endpoint >----------------------
[INFO] Building baz-endpoint 1.1.45-SNAPSHOT
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:3.2.0:get (default-cli) @ baz-endpoint ---
[INFO] Resolving com.foomedia:bar-utils:jar:1.1.33 with transitive dependencies
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  1.190 s
[INFO] Finished at: 2022-02-13T11:43:45+01:00
[INFO] ------------------------------------------------------------------------

but, versions cannot find it:

drijfhout@WS01:~/workspace$ JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64 /usr/local/apache-maven-3.8.4/bin/mvn versions:use-releases -DfailIfNotReplaced=true
[INFO] Scanning for projects...
[INFO]
[INFO] ----------------------< com.foomedia:baz-endpoint >----------------------
[INFO] Building baz-endpoint 1.1.45-SNAPSHOT
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- versions-maven-plugin:2.9.0:use-releases (default-cli) @ baz-endpoint ---
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.810 s
[INFO] Finished at: 2022-02-13T11:42:00+01:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.codehaus.mojo:versions-maven-plugin:2.9.0:use-releases (default-cli) on project baz-endpoint: Execution default-cli of goal org.codehaus.mojo:versions-maven-plugin:2.9.0:use-releases failed: No matching release of com.foomedia:bar-utils:jar:1.1.33-SNAPSHOT found for update. -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/PluginExecutionException

Why? Perhaps it's related to #529?

[slawekjaranowski]

Please try with the latest plugin version

[martin-d-aleksandrov]

Hello,
I just hit the same issue and it is still reproducible for me, even with the last version (2.11.0).
Any other ideas?

Thanks,
Martin

[ARManakhov]

Hello, I experiencing same issue, and found reason why it not working with gitlab maven repository.
First i was trying to run maven with -X flag, and in logs i found that plugin can't get package metadata from repository.

[DEBUG] Looking for newer versions of groupId:artifactId:jar:0.1.1
[DEBUG] Determining update check for artifact groupId:artifactId (/home/sirosh/.m2/repository/groupId/artifactId/maven-metadata-gitlab-maven.xml) from gitlab-maven (https://gitlab.example.com/api/v4/groups/6/-/packages/maven)
[DEBUG] Searching for gitlab-maven.maven-metadata-gitlab-maven.xml.lastUpdated in resolution tracking file.
[DEBUG] Skipped unreadable resolution tracking file /home/sirosh/.m2/repository/groupId/artifactId/resolver-status.properties
[INFO] artifact groupId:artifactId: checking for updates from gitlab-maven
[DEBUG] repository metadata for: 'artifact groupId:artifactId' could not be found on repository: gitlab-maven

And after further investigation found out that request to gitlab return status 404 in DefaultRepositoryMetadataManager class (that part of maven). This happens because of specific authentication in gitlab repo (it use Private-Token http header, but i don't see it in request) and wagonManager (in DefaultRepositoryMetadataManager) can't handle it. But also i found out that plugin uses deprecated ArtifactMetadataSource class, i think we have problems because of it. I can make a patch but i don't know which class to use instead of deprecated one, can some one give me advice ?.

[martin-d-aleksandrov]

Hello, I experiencing same issue, and found reason why it not working with gitlab maven repository. First i was trying to run maven with -X flag, and in logs i found that plugin can't get package metadata from repository.

[DEBUG] Looking for newer versions of groupId:artifactId:jar:0.1.1
[DEBUG] Determining update check for artifact groupId:artifactId (/home/sirosh/.m2/repository/groupId/artifactId/maven-metadata-gitlab-maven.xml) from gitlab-maven (https://gitlab.example.com/api/v4/groups/6/-/packages/maven)
[DEBUG] Searching for gitlab-maven.maven-metadata-gitlab-maven.xml.lastUpdated in resolution tracking file.
[DEBUG] Skipped unreadable resolution tracking file /home/sirosh/.m2/repository/groupId/artifactId/resolver-status.properties
[INFO] artifact groupId:artifactId: checking for updates from gitlab-maven
[DEBUG] repository metadata for: 'artifact groupId:artifactId' could not be found on repository: gitlab-maven

And after further investigation found out that request to gitlab return status 404 in DefaultRepositoryMetadataManager class (that part of maven). This happens because of specific authentication in gitlab repo (it use Private-Token http header, but i don't see it in request) and wagonManager (in DefaultRepositoryMetadataManager) can't handle it. But also i found out that plugin uses deprecated ArtifactMetadataSource class, i think we have problems because of it. I can make a patch but i don't know which class to use instead of deprecated one, can some one give me advice ?.

My investigation also led me to the ArtifactMetadataSource class (though, not sure about the rest of what you described). What I noticed was that when using the gitlab repo, my local repo filesystem has differences with regards to maven-metadata.xml files. Artifacts downloaded from different repos were containing one more maven-metadata.xml file on the artifact folder level (not version folders ). Further debugging showed that ArtifactMetadataSource is searching for exactly the same file in order to find the available versions. When not found it fails.

[andrzejj0]

Looks like the new implementation is MavenMetadataSource.

[slawekjaranowski]

ArtifactMetadataSource is deprecated - we should try replace it
https://lists.apache.org/thread/pd0onvrr0x4d5ctcphfjmscb5obm8or4

[slawekjaranowski]

Can anybody confirm that was resolved or still exists?

[slawekjaranowski]

I assume that was fixed.

[MattVonVielen]

For future folks searching this same issue with GitLab private repos; this issue still existed at least as recently as plugin version 2.10.0, but it is resolved in 2.16.0 (perhaps earlier).