In a Maven repository entry in the POM, are snapshots enabled by default?

user_32453 0
Viewed 2054

A Maven POM may define a "repository". For example,

  <repositories>
    <repository>
      <id>central</id>
      <name>Central Repository</name>
      <url>https://repo.maven.apache.org/maven2</url>
      <layout>default</layout>
      <snapshots>
        <enabled>false</enabled>
      </snapshots>
    </repository>
  </repositories>

What if I don't declare <snapshots> or <releases>? What are the defaults? They seem optional...

According to How does a Maven repository work?

<releases> is enabled by default on all repositories. I assume <snapshots> is disabled by default? So is the above snippet redundant?

maven java
4 Answers

TL;DR: Yes, snapshots are enabled by default if we configure a <repository> in pom.xml

If we think through, even when we don't specify any <repository> in our pom.xml file, Maven downloads the artifacts from the default repository. This is because the default 'Central' repository is configured in the Super POM.

An excerpt from Super POM's page:

Similar to the inheritance of objects in object oriented programming, POMs that extend a parent POM inherit certain values from that parent. Moreover, just as Java objects ultimately inherit from java.lang.Object, all Project Object Models inherit from a base Super POM. The snippet below is the Super POM for Maven 3.5.4.

    <repository>
        <id>central</id>
        <name>Central Repository</name>
        <url>https://repo.maven.apache.org/maven2</url>
        <layout>default</layout>
        <snapshots>
            <enabled>false</enabled>
        </snapshots>
    </repository> </repositories> ```

Because of this configuration, snapshot downloads 'by default' only 'from the central Maven repository' are disabled.

But if we specify <repository> in our pom.xml, then by default the snapshots are enabled. You can find the default value of enabled as true here:

Enter image description here

All that being said, I recommend we set that so that other developers would 'get' why their snapshot JAR file is not downloaded from Artifactory. It provides more clarity and given that it's not exposed other than in the codebase, it doesn't 'harm' anyone.

user_133093440

The official documentation does not explicitly state any default setting: https://maven.apache.org/pom.html#Repositories

So I assume the current "default" behavior is just "what is the easiest way for the developer to implement it" and this may change in the future when new features are added.

So if you want to be safe, then explicitly state what you want.

Admin1

Short answer

  • releases: Default value is: true.
  • snapshots: Default value is: true.

Check the official documentation: https://maven.apache.org/ref/3.6.2/maven-settings/settings.html

releases

Download policy

Element Type Description
enabled boolean Whether to use this repository for downloading this type of artifact. Default value is: true.
updatePolicy String The frequency for downloading updates - can be "always", "daily" (default), "interval:XXX" (in minutes) or "never" (only if it doesn't exist locally).
checksumPolicy String What to do when verification of an artifact checksum fails - warn, fail, etc. Valid values are "fail" or "warn".

snapshots

Download policy

Element Type Description
enabled boolean Whether to use this repository for downloading this type of artifact. Default value is: true.
updatePolicy String The frequency for downloading updates - can be "always", "daily" (default), "interval:XXX" (in minutes) or "never" (only if it doesn't exist locally).
checksumPolicy String What to do when verification of an artifact checksum fails - warn, fail, etc. Valid values are "fail" or "warn".
user_31384080

Default value for <enabled /> tag is true,
but the <snapshots> tag is not there by default.

Repository managers like Nexus OSS (developed by the same company as maven itself) usually have repositories specially for releases and for snapshots. Even if (experienced) Nexus admin put repositories into groups, then there should be group for release versions and group for snapshot versions.

Note that maven will look for check within snapshot repositories only when looking for snapshot dependency https://stackoverflow.com/a/5907727/482717

  <repositories>
    <repository>
      <name>Nexus Releases</name>
      <id>releases-repo</id>
      <url>https://oss.sonatype.org/content/repositories/releases</url>
    </repository>

    <repository>
      <snapshots>
        <enabled />
      </snapshots>
      <name>Nexus Snapshots</name>
      <id>snapshots-repo</id>
      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
    </repository>


  </repositories>

And you want as build master is usually clear control, whether your project is using only release version (and so is more stable) or is using snapshot versions (and so can break with any next build). As an advise, stay out of maven snapshot for own artifacts and for external, they complicate things too much, not worth it.

Keep things simple in your build, and demand so for other teams you depend on.

user_4827170
Related