Management of maven-plugin-annotations causes warnings with Maven 4.0.0-beta-3

[wilkinsona]

The management of maven-plugin-annotations, when inherited by the boms of other Apache projects, is causing a warning with Maven 4.0.0-beta-3. The warning can be reproduced with the following pom.xml:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<groupId>com.example</groupId>
	<artifactId>example</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<name>example</name>
	<dependencyManagement>
		<dependencies>
			<dependency>
				<groupId>org.apache.pulsar</groupId>
				<artifactId>pulsar-bom</artifactId>
				<version>3.3.1</version>
				<scope>import</scope>
				<type>pom</type>
			</dependency>
			<dependency>
				<groupId>org.apache.activemq</groupId>
				<artifactId>artemis-bom</artifactId>
				<version>2.36.0</version>
				<scope>import</scope>
				<type>pom</type>
			</dependency>
		</dependencies>
	</dependencyManagement>
</project>

The warning is as follows:

[WARNING] Some problems were encountered while building the effective model for 'com.example:example:jar:0.0.1-SNAPSHOT'
[WARNING] Ignored POM import for: org.apache.maven.plugin-tools:maven-plugin-annotations:jar:3.13.1@compile as already imported org.apache.maven.plugin-tools:maven-plugin-annotations:jar:3.7.0@compile.  Add a the conflicting managed dependency directly to the dependencyManagement section of the POM.

[cstamas]

Just some context: BOM use in Maven wildly differs from "ordinary" dependencies and many times cause (unwanted) surprise to end users. Hence, Maven 4 is getting more strict about them, and warns in any "unexpected" situation happens while flattening them (as part of Project building). Problems usually occur when "uber BOMs" are used, with many hundreds or thousands of import, and even worse, with recursive "BOM imports BOM..." chains.

Hence, I'd argue, that given BOM sole purpose is to provide dependency management entries downstream, hence all it should contain is dependency management entries, that BOMs should not have even parents. As we can see from this issue, when BOM has parent, it effectively loses control over its main purpose of existence.

[gnodet]

That managed dependency should go away. Especially with Maven 4 plugins for which that dependency should not be added.