{"record":{"id":"2ca0edd87569db58","repo":"apache/maven","slug":"version-not-locked-for-default-bindings-plugins-2ca0ed","errorCode":null,"errorMessage":"Version not locked for default bindings plugins {}, you should define versions in pluginManagement section of your pom.xml or parent","messagePattern":"Version not locked for default bindings plugins (.+?), you should define versions in pluginManagement section of your pom\\.xml or parent","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"impl/maven-core/src/main/java/org/apache/maven/lifecycle/internal/concurrent/BuildPlanExecutor.java","lineNumber":304,"sourceCode":"\n            return plan;\n        }\n\n        private void checkUnboundVersions(BuildPlan buildPlan) {\n            String defaulModelId = DefaultLifecycleRegistry.DEFAULT_LIFECYCLE_MODELID;\n            List<String> unversionedPlugins = buildPlan\n                    .allSteps()\n                    .flatMap(step -> step.mojos.values().stream().flatMap(map -> map.values().stream()))\n                    .map(MojoExecution::getPlugin)\n                    .filter(p -> p.getLocation(\"version\") != null\n                            && p.getLocation(\"version\").getSource() != null\n                            && defaulModelId.equals(\n                                    p.getLocation(\"version\").getSource().getModelId()))\n                    .distinct()\n                    .map(Plugin::getArtifactId) // managed by us, groupId is always o.a.m.plugins\n                    .toList();\n            if (!unversionedPlugins.isEmpty()) {\n                logger.warn(\"Version not locked for default bindings plugins \" + unversionedPlugins\n                        + \", you should define versions in pluginManagement section of your \" + \"pom.xml or parent\");\n            }\n        }\n\n        private void checkThreadSafety(BuildPlan buildPlan) {\n            if (threads > 1) {\n                Set<MojoExecution> unsafeExecutions = buildPlan\n                        .allSteps()\n                        .flatMap(step -> step.mojos.values().stream().flatMap(map -> map.values().stream()))\n                        .filter(execution -> !execution.getMojoDescriptor().isV4Api())\n                        .collect(Collectors.toSet());\n                if (!unsafeExecutions.isEmpty()) {\n                    for (String s : MultilineMessageHelper.format(\"\"\"\n                                Your build is requesting concurrent execution, but this project contains the \\\n                                following plugin(s) that have goals not built with Maven 4 to support concurrent \\\n                                execution. While this /may/ work fine, please look for plugin updates and/or \\\n                                request plugins be made thread-safe. If reporting an issue, report it against the \\\n                                plugin in question, not against Apache Maven.\"\"\")) {","sourceCodeStart":286,"sourceCodeEnd":322,"githubUrl":"https://github.com/apache/maven/blob/e4093d4e120eac99d6bdce5ba67cace2f3085c97/impl/maven-core/src/main/java/org/apache/maven/lifecycle/internal/concurrent/BuildPlanExecutor.java#L286-L322","documentation":"Identical check to BuilderCommon's, implemented in the Maven 4 concurrent BuildPlanExecutor: it walks buildPlan.allSteps() over every step's mojo maps, finds MojoExecutions whose plugin version originates from the default lifecycle bindings model, and warns that those default-binding plugin versions are not locked. It fires under the new concurrent builder when the plan still relies on Maven-provided default versions.","triggerScenarios":"Building with Maven 4's concurrent BuildPlanExecutor (session with threads > 1 routed to the concurrent starter) on a project whose default-bound core plugins (compiler, surefire, jar, install, deploy...) have no explicit version in the POM or parent.","commonSituations":"Migrating a Maven 3 multi-module project to Maven 4; reproducibility checks in CI comparing Maven 3 vs 4 output; companies enforcing 'all plugin versions pinned' policies detecting legacy modules.","solutions":["Pin all listed plugin artifactIds with explicit versions in <pluginManagement> (in the module or better the corporate parent).","Use 'mvn help:effective-pom' or 'mvn versions:display-plugin-updates' to discover which versions to pin.","Verify with a clean rebuild that the warning is gone and output artifacts no longer vary across Maven versions."],"exampleFix":"<!-- before -->\n<plugin><artifactId>maven-surefire-plugin</artifactId></plugin>\n\n<!-- after -->\n<pluginManagement>\n  <plugins>\n    <plugin>\n      <groupId>org.apache.maven.plugins</groupId>\n      <artifactId>maven-surefire-plugin</artifactId>\n      <version>3.5.2</version>\n    </plugin>\n  </plugins>\n</pluginManagement>","handlingStrategy":"validation","validationCode":"# guard: same check under Maven 4 concurrent builder\nmvn -T 1C -Dstyle.color=never verify 2>&1 \\\n  | grep -q 'Version not locked for default bindings' \\\n  && { echo 'pin default-binding plugins'; exit 1; } || true","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Inherit from a parent POM that locks all org.apache.maven.plugins versions.","Use versions:display-plugin-updates during migrations to Maven 4 to pick explicit versions."],"tags":["maven","maven-4","concurrent-build","plugin-versions","reproducible-builds"],"backgroundTag":"unpinned-maven-plugin-versions","analyzedSha":"e4093d4e120eac99d6bdce5ba67cace2f3085c97","analyzedAt":"2026-08-21T22:58:24.034Z","schemaVersion":2},"datasetVersion":"2026-08-22T04:17:13.399Z"}