maven-resolver icon indicating copy to clipboard operation
maven-resolver copied to clipboard

[MNG-7559] Fix version comparison with case insensitive lexical order

Open sultan opened this issue 1 month ago • 5 comments

This PR description was edited to reflect its latest status:

Recurring issues show that Maven’s current handling of qualifiers is incomplete, impacting multiple companies and users:

  • mojohaus/versions#744
  • https://github.com/apache/maven/issues/8891
  • https://github.com/dependabot/dependabot-core/pull/6747
  • https://github.com/dependabot/dependabot-core/pull/10207

These issues need to be addressed in Maven Resolver. I am working to encourage Maven to adopt a fix through this PR.

Proposed ordering:

  • alpha < beta < milestone < pr = pre = preview < rc = cr < dev < snapshot < final = ga = release < sp

I edited the documentation to discourage the use of certain qualifiers:

  • The use of pr, pre, preview is discouraged
  • The use of cr is discouraged (use rc instead)
  • The use of dev is discouraged
  • The use of final, ga, release is discouraged (use no qualifier instead)
  • The use of sp is discouraged (increment patch version instead)

Optional inclusions:

  • ea (early access), edr, pfd (drafts), mr

As long as discouraged qualifiers continue to be used in practice, tools will still need to support them. Once they are phased out, however, support can be safely dropped.

Another possible direction would be:

  • Partial SemVer2 support, which could simplify handling of qualifiers:
    • Accept the "+" char as a separator.
    • Temporarily treat discouraged qualifiers as follows (while discouraging their use when necessary):
      • latest pre-release: dev, snapshot
      • release: final, ga, release
      • post-release: sp
    • Treat all other qualifiers as pre-release without hard-coding them, reducing the number of special cases.
    • Use aliases/mapping:
      • a to alpha
      • b to beta
      • m to milestone
      • cr to rc
      • "final", "ga", "release" to ""
  • Maven could force the build to fail if any module uses discouraged qualifiers.
  • Maven Central could begin rejecting new artifacts using discouraged qualifiers.

Thanks for your input.


Following this checklist to help us incorporate your contribution quickly and easily:

  • [x] Your pull request should address just one issue, without pulling in other changes.
  • [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • [x] Each commit in the pull request should have a meaningful subject line and body. Note that commits might be squashed by a maintainer on merge.
  • [x] Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible but is a best-practice.
  • [x] Run mvn verify to make sure basic checks pass. A more thorough check will be performed on your pull request automatically.
  • [ ] You have run the integration tests successfully (mvn -Prun-its verify).

If your pull request is about ~20 lines of code you don't need to sign an Individual Contributor License Agreement if you are unsure please ask on the developers list.

To make clear that you license your contribution under the Apache License Version 2.0, January 2004 you have to acknowledge this by using the following check-box.

sultan avatar Nov 20 '25 19:11 sultan