apache/maven · warning

Version not locked for default bindings plugins {}, you shou

Error message

Version not locked for default bindings plugins {}, you should define versions in pluginManagement section of your pom.xml or parent

What it means

Identical check to BuilderCommon's, implemented in the Maven 4 concurrent BuildPlanExecutor: it walks buildPlan.allSteps() over every step's mojo maps, finds MojoExecutions whose plugin version originates from the default lifecycle bindings model, and warns that those default-binding plugin versions are not locked. It fires under the new concurrent builder when the plan still relies on Maven-provided default versions.

Source

Thrown at impl/maven-core/src/main/java/org/apache/maven/lifecycle/internal/concurrent/BuildPlanExecutor.java:304

            return plan;
        }

        private void checkUnboundVersions(BuildPlan buildPlan) {
            String defaulModelId = DefaultLifecycleRegistry.DEFAULT_LIFECYCLE_MODELID;
            List<String> unversionedPlugins = buildPlan
                    .allSteps()
                    .flatMap(step -> step.mojos.values().stream().flatMap(map -> map.values().stream()))
                    .map(MojoExecution::getPlugin)
                    .filter(p -> p.getLocation("version") != null
                            && p.getLocation("version").getSource() != null
                            && defaulModelId.equals(
                                    p.getLocation("version").getSource().getModelId()))
                    .distinct()
                    .map(Plugin::getArtifactId) // managed by us, groupId is always o.a.m.plugins
                    .toList();
            if (!unversionedPlugins.isEmpty()) {
                logger.warn("Version not locked for default bindings plugins " + unversionedPlugins
                        + ", you should define versions in pluginManagement section of your " + "pom.xml or parent");
            }
        }

        private void checkThreadSafety(BuildPlan buildPlan) {
            if (threads > 1) {
                Set<MojoExecution> unsafeExecutions = buildPlan
                        .allSteps()
                        .flatMap(step -> step.mojos.values().stream().flatMap(map -> map.values().stream()))
                        .filter(execution -> !execution.getMojoDescriptor().isV4Api())
                        .collect(Collectors.toSet());
                if (!unsafeExecutions.isEmpty()) {
                    for (String s : MultilineMessageHelper.format("""
                                Your build is requesting concurrent execution, but this project contains the \
                                following plugin(s) that have goals not built with Maven 4 to support concurrent \
                                execution. While this /may/ work fine, please look for plugin updates and/or \
                                request plugins be made thread-safe. If reporting an issue, report it against the \
                                plugin in question, not against Apache Maven.""")) {

View on GitHub (pinned to e4093d4e12)

Solutions

1. Pin all listed plugin artifactIds with explicit versions in <pluginManagement> (in the module or better the corporate parent).
2. Use 'mvn help:effective-pom' or 'mvn versions:display-plugin-updates' to discover which versions to pin.
3. Verify with a clean rebuild that the warning is gone and output artifacts no longer vary across Maven versions.

Example fix

<!-- before -->
<plugin><artifactId>maven-surefire-plugin</artifactId></plugin>

<!-- after -->
<pluginManagement>
  <plugins>
    <plugin>
      <groupId>org.apache.maven.plugins</groupId>
      <artifactId>maven-surefire-plugin</artifactId>
      <version>3.5.2</version>
    </plugin>
  </plugins>
</pluginManagement>

# guard: same check under Maven 4 concurrent builder
mvn -T 1C -Dstyle.color=never verify 2>&1 \
  | grep -q 'Version not locked for default bindings' \
  && { echo 'pin default-binding plugins'; exit 1; } || true

When it happens

Trigger: Building with Maven 4's concurrent BuildPlanExecutor (session with threads > 1 routed to the concurrent starter) on a project whose default-bound core plugins (compiler, surefire, jar, install, deploy...) have no explicit version in the POM or parent.

Common situations: Migrating a Maven 3 multi-module project to Maven 4; reproducibility checks in CI comparing Maven 3 vs 4 output; companies enforcing 'all plugin versions pinned' policies detecting legacy modules.

Related errors

• Version not locked for default bindings plugins {}, you shou
• Your build is requesting concurrent execution, but this proj
• The following goals are not Maven 4 goals:
• The following plugins are not Maven 4 plugins:
• Enable verbose output (-X) to see precisely which goals are

AI-assisted analysis of apache/maven@e4093d4e12 (2026-08-21). Data as JSON: /api/errors/2ca0edd87569db58. Report an issue: GitHub.