{"record":{"id":"419cb16677dfe142","repo":"apache/maven","slug":"invalid-version-for-dependency-dependency-getm","errorCode":null,"errorMessage":"Invalid version for dependency \" + dependency.getManagementKey() + \": \" + e.getMessage()","messagePattern":"Invalid version for dependency \" \\+ dependency\\.getManagementKey\\(\\) \\+ \": \" \\+ e\\.getMessage\\(\\)","errorType":"exception","errorClass":"ArtifactMetadataRetrievalException","httpStatus":null,"severity":"error","filePath":"compat/maven-compat/src/main/java/org/apache/maven/project/artifact/MavenMetadataSource.java","lineNumber":343,"sourceCode":"                }\n            }\n\n            repositories = new ArrayList<>(repos.values());\n        }\n\n        return repositories;\n    }\n\n    private Artifact createDependencyArtifact(Dependency dependency, Artifact owner, Artifact pom)\n            throws ArtifactMetadataRetrievalException {\n        try {\n            String inheritedScope = (owner != null) ? owner.getScope() : null;\n\n            ArtifactFilter inheritedFilter = (owner != null) ? owner.getDependencyFilter() : null;\n\n            return createDependencyArtifact(artifactFactory, dependency, inheritedScope, inheritedFilter);\n        } catch (InvalidVersionSpecificationException e) {\n            throw new ArtifactMetadataRetrievalException(\n                    \"Invalid version for dependency \" + dependency.getManagementKey() + \": \" + e.getMessage(), e, pom);\n        }\n    }\n\n    private static Artifact createDependencyArtifact(\n            ArtifactFactory factory, Dependency dependency, String inheritedScope, ArtifactFilter inheritedFilter)\n            throws InvalidVersionSpecificationException {\n        String effectiveScope = getEffectiveScope(dependency.getScope(), inheritedScope);\n\n        if (effectiveScope == null) {\n            return null;\n        }\n\n        VersionRange versionRange = VersionRange.createFromVersionSpec(dependency.getVersion());\n\n        Artifact dependencyArtifact = factory.createDependencyArtifact(\n                dependency.getGroupId(),\n                dependency.getArtifactId(),","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/apache/maven/blob/e4093d4e120eac99d6bdce5ba67cace2f3085c97/compat/maven-compat/src/main/java/org/apache/maven/project/artifact/MavenMetadataSource.java#L325-L361","documentation":"Thrown by MavenMetadataSource while creating an Artifact for a transitive dependency during metadata retrieval (the legacy resolution path used to discover a dependency's dependencies). createDependencyArtifact catches InvalidVersionSpecificationException from the artifact factory and rethrows it as ArtifactMetadataRetrievalException, naming the dependency's management key (groupId:artifactId:type) and the invalid spec. This means the <version> of some dependency in the resolved graph is not a parseable version or range.","triggerScenarios":"A dependency (usually a transitive one, in a POM Maven just fetched) has a malformed version string: unbalanced range like '[1.0,2.0', empty bounds, or a non-parseable literal such that VersionRange/DefaultArtifactVersion parsing throws InvalidVersionSpecificationException.","commonSituations":"A third-party POM published with a broken version range; a property left unresolved in a consumed POM (version literally '${foo.version}'); mixed old Maven 2-era metadata; LATEST/RELEASE markers in odd positions; corrupt downloaded POM in the local repo.","solutions":["Run with -X to see the full graph and identify which artifact's POM carries the bad version (the management key in the message names it)","Delete the offending artifact's directory under ~/.m2/repository and re-resolve in case the cached POM is corrupt","If the bad version comes from a dependencyManagement section you control, correct the version/range there","Exclude the offending dependency (<exclusions>) or pin a good version via dependencyManagement until upstream fixes their POM","Report/fix the broken POM in the project that publishes it"],"exampleFix":"<!-- before: broken range pulled in transitively -->\n<dependency>\n  <groupId>bad.libs</groupId><artifactId>bad-lib</artifactId><version>[1.0,2.0</version>\n</dependency>\n<!-- after: pin a fixed version or exclude -->\n<dependencyManagement>\n  <dependencies>\n    <dependency>\n      <groupId>bad.libs</groupId><artifactId>bad-lib</artifactId><version>1.5</version>\n    </dependency>\n  </dependencies>\n</dependencyManagement>","handlingStrategy":"validation","validationCode":"// Pre-parse every dependency version you control before the build\ntry {\n    org.apache.maven.artifact.versioning.VersionRange.createFromVersionSpec(dep.getVersion());\n} catch (org.apache.maven.artifact.versioning.InvalidVersionSpecificationException e) {\n    fail(\"dependency \" + dep.getManagementKey() + \" has invalid version: \" + dep.getVersion());\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin exact versions in dependencyManagement to shield against broken transitive ranges","Lint your own POM versions in CI (enforcer requireUpperBoundDeps or a custom rule)","Purge suspect artifacts from the local repo when messages look like corruption"],"tags":["maven","dependency","version-range","transitive","resolution"],"backgroundTag":"invalid-version-range","analyzedSha":"e4093d4e120eac99d6bdce5ba67cace2f3085c97","analyzedAt":"2026-08-21T22:58:24.034Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}