Affected version

3.9.9

Bug description

When resolving a version range, the Maven resolution will query metadata from all configured repositories, without regard to whether that repository is enabled for snapshots or not. However, it seems that the default resolution behavior is to exclude snapshot versions from resolution unless at least one of the bounds of the range refers to a snapshot version. So, most version ranges should not need to query repositories that are configured for snapshots only.

This is a problem because unnecessary queries can cause performance problems, and can even lead to blocks/bans.

If the version range does not contain a snapshot version in its bounds, only repositories configured for releases should be queried. Any repositories configured for snapshots only should be excluded, and should never be queried, as they should only be used for snapshots, and snapshot versions should already be excluded from a possible the resolution of the range.

Because of this bug, even a properly configured project, that only uses a snapshot repository in a limited way during development, can be affected by introducing a version range anywhere in a project's dependency tree.

In summary: when resolving release version ranges, snapshot repositories should be excluded from consideration before any metadata is queried.

This is related to:

• PR Avoid unnecessarily accessing snapshot repositories accumulo#5709 attempts to work around the issue for Apache Accumulo developers, where it appears that a version range in a transitive dependency on bouncycastle caused those developers to be blocked by too many 404s against repository.apache.org, when repository.apache.org should never have been queried for bouncycastle, but it was because of this bug
• PR [MPOM-451] Move snapshot repositories in a profile maven-apache-parent#183 removes the snapshot from the Apache parent POM by default
• Issue Documentation says that version ranges should not resolve to SNAPSHOT, but SNAPSHOT repos are still queried maven-enforcer#906 highlights that the linked documentation about version ranges excludes SNAPSHOTS unless a snapshot version is explicitly one of the bounds of the version range
• Comment at MPOM-451 indicates correctly that this behavior can lead to being blocked by INFRA for too many 404s

This probably affects earlier versions, but 3.9.9 is the earliest I've tried.

There are several workarounds, but none of them are perfect. Here are two:

1. Avoid version ranges using a maven-enforcer-plugin rule against dynamic versions. While I agree that version ranges should generally be avoided, they do have some valid use cases.
2. Ensure that no pom or settings have any snapshot repositories enabled. This may not be practical, because there may be a need to use some SNAPSHOT versions on occasion, during development. In these cases, the resolution of version ranges for releases should not cause the snapshot repository to be queried. Only the resolution of the snapshot dependency should cause the snapshot repository to be queried.