In a Maven repository entry in the POM, are snapshots enabled by default?

Question

A Maven POM may define a "repository". For example,

  <repositories>
    <repository>
      <id>central</id>
      <name>Central Repository</name>
      <url>https://repo.maven.apache.org/maven2</url>
      <layout>default</layout>
      <snapshots>
        <enabled>false</enabled>
      </snapshots>
    </repository>
  </repositories>

What if I don't declare <snapshots> or <releases>? What are the defaults? They seem optional...

According to How does a Maven repository work?

<releases> is enabled by default on all repositories. I assume <snapshots> is disabled by default? So is the above snippet redundant?

As a note, `mvn help:effective-pom` may be useful in figuring out questions relating to defaults. — chrylis -cautiouslyoptimistic-, May 08 '20 at 18:12
OK I tried `mvn help:effective-pom` but for whatever reason it just collapses down repositories "to the defaults" like ` centrallll Central Repository https://repo.maven.apache.org/maven2 ` but I could compare that with what I specified to see which ones it views as "not default", good idea! — rogerdpack, May 08 '20 at 18:20

score 7 · Accepted Answer · edited Jul 07 '21 at 12:01

7

TL;DR: Yes, snapshots are enabled by default if we configure a <repository> in pom.xml

If we think through, even when we don't specify any <repository> in our pom.xml file, Maven downloads the artifacts from the default repository. This is because the default 'Central' repository is configured in the Super POM.

An excerpt from Super POM's page:

Similar to the inheritance of objects in object oriented programming, POMs that extend a parent POM inherit certain values from that parent. Moreover, just as Java objects ultimately inherit from java.lang.Object, all Project Object Models inherit from a base Super POM. The snippet below is the Super POM for Maven 3.5.4.
    <repository>
        <id>central</id>
        <name>Central Repository</name>
        <url>https://repo.maven.apache.org/maven2</url>
        <layout>default</layout>
        <snapshots>
            <enabled>false</enabled>
        </snapshots>
    </repository> </repositories> ```

Because of this configuration, snapshot downloads 'by default' only 'from the central Maven repository' are disabled.

But if we specify <repository> in our pom.xml, then by default the snapshots are enabled. You can find the default value of enabled as true here:

All that being said, I recommend we set that so that other developers would 'get' why their snapshot JAR file is not downloaded from Artifactory. It provides more clarity and given that it's not exposed other than in the codebase, it doesn't 'harm' anyone.

edited Jul 07 '21 at 12:01

Peter Mortensen

30,738
21
105
131

answered May 08 '20 at 17:22

kayvis

563
2
9

Hmm I understand that all pom's inherit from the "super" pom (so they have that repository...defined), but if I define new repositories...it's not saying new repositories inherit from the super POM's repository I don't think. I guess it's just implied default false...,maybe the super pom is trying to teach us "these is how it is by default" :) – rogerdpack May 08 '20 at 17:47
That's what I'm trying to look up. Looks like the default value for `` under `` is `true`. You can try that out in Eclipse suggestions if you try with a sample repository tag. Sample here: https://imgur.com/rbkmEJB. So looks like the rule is, if we don't override, it's disabled by default through Super POM. If we have a repository configured, snapshot is enabled by default. – kayvis May 08 '20 at 17:56
OK I added a repo without `snapshots` specified, and ran `mvn -X` which showed this: `Repositories (dependencies): [... , my_new_repo (https://repo.maven.apache.org/maven2, default, releases+snapshots)` so it appears you're right, if it isn't specified, it defaults to true, thanks for the help! – rogerdpack May 08 '20 at 18:22
1

Exactly! Thanks to you too for pointing out. I'm currently working on updating my answer with much more details for clarity :) – kayvis May 08 '20 at 18:24
1

@rogerdpack, I've made a complete overhaul to my initial answer. Let me know if we've covered everything w.r.t the initial question. – kayvis May 08 '20 at 18:39

score 1 · Answer 2 · edited Jul 07 '21 at 11:57

1

The official documentation does not explicitly state any default setting: https://maven.apache.org/pom.html#Repositories

So I assume the current "default" behavior is just "what is the easiest way for the developer to implement it" and this may change in the future when new features are added.

So if you want to be safe, then explicitly state what you want.

edited Jul 07 '21 at 11:57

Peter Mortensen

30,738
21
105
131

answered May 08 '20 at 17:19

I love it when they don't document anything...gah :) – rogerdpack May 11 '20 at 16:05

siqi · Answer 3 · 2021-08-30T09:44:14.510

Short answer

releases: Default value is: true.
snapshots: Default value is: true.

Check the official documentation: https://maven.apache.org/ref/3.6.2/maven-settings/settings.html

releases

Download policy

Element	Type	Description
`enabled`	`boolean`	Whether to use this repository for downloading this type of artifact. Default value is: `true`.
`updatePolicy`	`String`	The frequency for downloading updates - can be "always", "daily" (default), "interval:XXX" (in minutes) or "never" (only if it doesn't exist locally).
`checksumPolicy`	`String`	What to do when verification of an artifact checksum fails - warn, fail, etc. Valid values are "fail" or "warn".

snapshots

Download policy

Element	Type	Description
`enabled`	`boolean`	Whether to use this repository for downloading this type of artifact. Default value is: `true`.
`updatePolicy`	`String`	The frequency for downloading updates - can be "always", "daily" (default), "interval:XXX" (in minutes) or "never" (only if it doesn't exist locally).
`checksumPolicy`	`String`	What to do when verification of an artifact checksum fails - warn, fail, etc. Valid values are "fail" or "warn".

Ahh there is a second section of documentation for it. You cracked the maven documentation code! :) — rogerdpack, Aug 30 '21 at 17:43

score 0 · Answer 4 · answered Jul 08 '21 at 03:09

Default value for <enabled /> tag is true,
but the <snapshots> tag is not there by default.

Repository managers like Nexus OSS (developed by the same company as maven itself) usually have repositories specially for releases and for snapshots. Even if (experienced) Nexus admin put repositories into groups, then there should be group for release versions and group for snapshot versions.

Note that maven will look for check within snapshot repositories only when looking for snapshot dependency https://stackoverflow.com/a/5907727/482717

  <repositories>
    <repository>
      <name>Nexus Releases</name>
      <id>releases-repo</id>
      <url>https://oss.sonatype.org/content/repositories/releases</url>
    </repository>

    <repository>
      <snapshots>
        <enabled />
      </snapshots>
      <name>Nexus Snapshots</name>
      <id>snapshots-repo</id>
      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
    </repository>


  </repositories>

And you want as build master is usually clear control, whether your project is using only release version (and so is more stable) or is using snapshot versions (and so can break with any next build). As an advise, stay out of maven snapshot for own artifacts and for external, they complicate things too much, not worth it.

Keep things simple in your build, and demand so for other teams you depend on.

In a Maven repository entry in the POM, are snapshots enabled by default?

4 Answers4

releases

snapshots

Linked