{"record":{"id":"f0b3a270d279f85e","repo":"apache/maven","slug":"version-not-locked-for-default-bindings-plugins","errorCode":null,"errorMessage":"Version not locked for default bindings plugins {}, you should define versions in pluginManagement section of your pom.xml or parent","messagePattern":"Version not locked for default bindings plugins (.+?), you should define versions in pluginManagement section of your pom\\.xml or parent","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"impl/maven-core/src/main/java/org/apache/maven/lifecycle/internal/builder/BuilderCommon.java","lineNumber":157,"sourceCode":"                }\n                logger.warn(MultilineMessageHelper.separatorLine());\n            }\n        }\n\n        final String defaulModelId = DefaultLifecycleRegistry.DEFAULT_LIFECYCLE_MODELID;\n\n        List<String> unversionedPlugins = executionPlan.getMojoExecutions().stream()\n                .map(MojoExecution::getPlugin)\n                .filter(p -> p.getLocation(\"version\") != null\n                        && p.getLocation(\"version\").getSource() != null\n                        && defaulModelId.equals(\n                                p.getLocation(\"version\").getSource().getModelId()))\n                .distinct()\n                .map(Plugin::getArtifactId) // managed by us, groupId is always o.a.m.plugins\n                .toList();\n\n        if (!unversionedPlugins.isEmpty()) {\n            logger.warn(\"Version not locked for default bindings plugins \" + unversionedPlugins\n                    + \", you should define versions in pluginManagement section of your \" + \"pom.xml or parent\");\n        }\n\n        return executionPlan;\n    }\n\n    public void handleBuildError(\n            final ReactorContext buildContext,\n            final MavenSession rootSession,\n            final MavenSession currentSession,\n            final MavenProject mavenProject,\n            Throwable t,\n            final Instant buildStartTime) {\n        // record the error and mark the project as failed\n        Instant buildEndTime = MonotonicClock.now();\n        buildContext.getResult().addException(t);\n        buildContext\n                .getResult()","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/apache/maven/blob/e4093d4e120eac99d6bdce5ba67cace2f3085c97/impl/maven-core/src/main/java/org/apache/maven/lifecycle/internal/builder/BuilderCommon.java#L139-L175","documentation":"BuilderCommon inspects the execution plan for plugins whose <version> comes from the default lifecycle bindings model (DefaultLifecycleRegistry.DEFAULT_LIFECYCLE_MODELID) rather than from the user's POM. Such versions float with the Maven version and are not 'locked'; Maven warns that you should declare them in pluginManagement. Only core groupId org.apache.maven.plugins bindings are considered, hence the artifactId-only list.","triggerScenarios":"A project (usually generated by an older archetype or hand-written) relies on implicit default bindings — e.g. a jar project with no explicit maven-surefire-plugin/maven-compiler-plugin versions — so p.getLocation(\"version\").getSource().getModelId() equals the default-bindings model id.","commonSituations":"Reproducibility audits: the same POM builds differently on Maven 3.8 vs 3.9 vs 4 because surefire/jar/install versions changed with the Maven distribution; CI 'works on my machine' drift after a Maven upgrade; builds behind an air-gapped repo that lacks the newly-defaulted plugin version.","solutions":["Copy the listed artifactIds into <build><pluginManagement><plugins> with explicit versions (run mvn help:effective-pom to see current defaults).","Adopt the oldest-allowed / version-locked parent approach (e.g. a corporate parent POM that pins all core plugins).","Run 'mvn versions:display-plugin-updates' to pick current versions, then pin them.","Re-run the build to confirm the warning disappears and builds are reproducible across Maven versions."],"exampleFix":"<!-- before: implicit versions from default bindings -->\n<artifactId>maven-jar-plugin</artifactId><!-- no version anywhere -->\n\n<!-- after: lock versions in pluginManagement -->\n<build>\n  <pluginManagement>\n    <plugins>\n      <plugin>\n        <groupId>org.apache.maven.plugins</groupId>\n        <artifactId>maven-jar-plugin</artifactId>\n        <version>3.4.2</version>\n      </plugin>\n    </plugins>\n  </pluginManagement>\n</build>","handlingStrategy":"validation","validationCode":"# guard: detect floating default-binding versions before they drift\nmvn -q help:effective-pom -Doutput=/tmp/eff.xml\nxmllint --xpath '//*[local-name()=\"plugin\" and not(*[local-name()=\"version\"])]/*[local-name()=\"artifactId\"]/text()' /tmp/eff.xml","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin every core plugin (compiler, surefire, jar, install, deploy, resources) in pluginManagement of a shared parent.","Add maven-enforcer requirePluginVersions rule so POMs cannot rely on implicit versions.","Re-run builds after Maven upgrades with locked versions to prove reproducibility."],"tags":["maven","plugin-versions","reproducible-builds","plugin-management","pom"],"backgroundTag":"unpinned-maven-plugin-versions","analyzedSha":"e4093d4e120eac99d6bdce5ba67cace2f3085c97","analyzedAt":"2026-08-21T22:58:24.034Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}