Fix/916 require same versions for managed report plugins

[dhruv9b]

Description

Fixes #916.

RequireSameVersions can incorrectly report different versions for a report plugin when the plugin version is managed through <pluginManagement>.

When a report plugin is declared without an explicit version, Maven can expose its artifact with version RELEASE, even though the plugin has a version defined in the project's <pluginManagement>.

For example, this can result in RequireSameVersions comparing:

maven-surefire-plugin        3.5.3
maven-surefire-report-plugin RELEASE

and incorrectly reporting a version mismatch.

Changes

The report-plugin version lookup now:

• Uses an explicitly configured version from the reporting plugin when available.
• Falls back to the version configured in the project's build <pluginManagement>.
• Falls back to the artifact version/base version when no configured or managed version is available.

The existing handling of <plugins>, <buildPlugins>, and <reportPlugins> is preserved.

Tests

Added a unit regression test covering a report plugin whose artifact version is RELEASE while its managed version is 3.5.3.

Added an integration test reproducing the issue with a report plugin whose version is provided through <pluginManagement>.

The existing RequireSameVersions tests and integration tests were also run to ensure the changes do not regress the behavior introduced by #892, where entries in <plugins> are considered when checking build and report plugins.

Fixes #916

[pzygielo]

• I've re-seen similar in Incorrect (overzealous) version of [managed] reporting plugin being verified s4u/pgpverify-maven-plugin#720.

Then I've re-found https://maven.apache.org/guides/mini/guide-configuring-plugins.html#Configuring_Reporting_Plugins

Important Note:
...
For reporting plugins, specify each version in the <reporting><plugins/></reporting> element (and in the <build><pluginManagement/></build> element too).

That has re-surprised me a lot, to encourage such duplication...

So for:

Added an integration test reproducing the issue with a report plugin whose version is provided through <pluginManagement>.

I'd like to confirm - report plugin version IS NOT provided by <pluginManagement>, is it?

[dhruv9b]

Contributor

Yes, the report plugin version is provided through <build><pluginManagement>, but it is intentionally not specified explicitly under <reporting><plugins>.

This matches the configuration from the original #916 reproducer. Maven allows the reporting plugin version to be resolved from <build><pluginManagement> when it is not specified in <reporting>.

The issue is that RequireSameVersions was seeing the report artifact with version RELEASE, while the corresponding build plugin was 3.5.3, even though the report plugin was managed at 3.5.3.

So the integration test intentionally leaves the reporting version unspecified to reproduce that exact case. The fix uses the managed version when no explicit reporting version is present.

[pzygielo]

I'm confused for following reasons:

• as also noted in RequireSameVersion failed even with defined versions of failsafe,surefire,surefire-report-plugin #916 (comment) - project.getReportArtifacts() - returns plugins w/o version if there is none specified in <reporting> section (exactly this causes Incorrect (overzealous) version of [managed] reporting plugin being verified s4u/pgpverify-maven-plugin#720 to use RELEASE/the latest, which is not the same as the one used in <pluginManagement>)
• Configuring_Reporting_Plugins says to provide explicit version in <reporting>
• the actual behavior of Maven itself is indeed to:

Maven allows the reporting plugin version to be resolved from when it is not specified in .

Can you link to some documentation that support:

Maven allows the reporting plugin version to be resolved from when it is not specified in

?

[pzygielo]

(I'm not challenging this PR in any way, just using this, perhaps not quite proper channel, to learn more about that case.)

[dhruv9b]

I'm confused for following reasons:

• as also noted in RequireSameVersion failed even with defined versions of failsafe,surefire,surefire-report-plugin #916 (comment) - project.getReportArtifacts() - returns plugins w/o version if there is none specified in <reporting> section (exactly this causes Incorrect (overzealous) version of [managed] reporting plugin being verified s4u/pgpverify-maven-plugin#720 to use RELEASE/the latest, which is not the same as the one used in <pluginManagement>)
• Configuring_Reporting_Plugins says to provide explicit version in <reporting>
• the actual behavior of Maven itself is indeed to:

Maven allows the reporting plugin version to be resolved from when it is not specified in .

Can you link to some documentation that support:

Maven allows the reporting plugin version to be resolved from when it is not specified in

?

Thanks for pointing this out. I’m still learning the Maven reporting/plugin resolution behavior, so I may be misunderstanding part of it.

I found the official Maven Model documentation for ReportPlugin#getVersion(), which states that starting with Maven 3, if no version is defined explicitly, Maven searches for the version in build/plugins and then build/pluginManagement:

https://maven.apache.org/ref/3.9.15/apidocs/org/apache/maven/model/ReportPlugin.html

The Maven Model reference documents the same behavior for the <reporting><plugins><plugin><version> element:

https://maven.apache.org/ref/3.9.15/maven-model/maven.html

So my current understanding is that the version can be resolved from build/pluginManagement even when it is not explicitly specified under <reporting>.

In the #916 reproducer, the report plugin is intentionally left without a version under <reporting>, while its version is managed under <build><pluginManagement>. The issue appears to be that project.getReportArtifacts() can still expose that report artifact with RELEASE, which is what causes the version comparison to differ from the corresponding build plugin.

I’ll review this behavior further to make sure I’m understanding Maven’s resolution correctly.

[pzygielo]

I found the official Maven Model documentation for ReportPlugin#getVersion(), which states that starting with Maven 3, if no version is defined explicitly, Maven searches for the version in build/plugins and then build/pluginManagement:

https://maven.apache.org/ref/3.9.15/apidocs/org/apache/maven/model/ReportPlugin.html

The Maven Model reference documents the same behavior for the <reporting><plugins><plugin><version> element:

https://maven.apache.org/ref/3.9.15/maven-model/maven.html

So my current understanding is that the version can be resolved from build/pluginManagement even when it is not explicitly specified under <reporting>.

Perfect! Thanks!

[dhruv9b]

Perfect! Thanks!

Thanks again for the question — I looked further into Maven's report plugin resolution to make sure the implementation matches Maven's behavior.

I found that the effective reporting plugin version is resolved in this order: an explicitly configured <reporting> version, then <build><plugins>, then <build><pluginManagement>.

My initial implementation only covered the explicit reporting version and pluginManagement. I’ve now updated the PR to also check build/plugins before pluginManagement, and added a unit test to verify that precedence.

I also verified the original #916 reproducer with the Maven Invoker integration test, which now passes successfully.