Maven 2.0.9 pins core plug-in versions

A common complaint about Maven was that builds weren’t reproducible because the versions of the plug-ins used could vary. Maven 2.0.8 and earlier always used the latest plug-in version available in the local repository. That meant you could get different build results depending on what was in that repository.

There is a workaround, specifying the plug-in versions in a central parent POM, but it doesn’t scale particularly well and isn’t very convenient. Release 2.0.9 addresses this by pinning the versions of core plug-ins in Maven’s own distribution (see the pluginManagement element in the super POM). That guarantees the core plug-in versions stay the same at least within the same Maven release, starting with 2.0.9, so they won’t undermine reproducibility. Inheritance still applies. If you specify your own core plug-in versions in the central POM, yours take precedence.

You may use plug-ins outside the core, of course, so the recommendation to declare versions in a central POM still stands. I’d call this change a smart default. The full explanation is in 2.0.9 brings a bit of stability to plugin versions, which is where I got this information.

Another larger change is that you can import dependency management from different POMs. Dependency management lets you declare the dependencies you use and collect them and their versions in one place. Before 2.0.9 you could only do this through inheritance between POMs. Version 2.0.9 introduces the import dependency scope, which lets you import dependency management from different POMs. If that sounds too abstract, read Importing Managed Dependencies.

I’d also recommend reading the release notes. There are quite a few fixes and small improvements.