versions-maven-plugin:display-plugin-updates does not show updates for plugin in pluginManagement

[pdeneve]

As requested in apache/maven-xinclude-extension#19, I'm creating the issue in the versions-maven-plugin repo.

When there's an update available vor a plugin for which it's version is managed in pluginManagement, versions-maven-plugin:display-plugin-updates does not show the available update.

To reproduce:

git clone https://gitlab.com/philippedn/jptb.git
cd jptb
sed -i 's/3\.8\.1/3.8.0/' plugin-management.xml # will downgrade maven-dependency-plugin from 3.8.1 to 3.8.0
sed -i 's/3\.4\.1/3.5.0/' plugin-management.xml # see https://github.com/mojohaus/versions/issues/1239#issuecomment-3263826152
./mvnw versions:display-plugin-updates

This will output:

...
[INFO] All plugins with a version specified are using the latest versions.
...

[andrzejj0]

Unable to reproduce.

[pdeneve]

I see in the output now the following instead of [INFO] All plugins with a version specified are using the latest versions.:

[INFO]   maven-clean-plugin ................................. 3.4.1 -> 3.5.0

Apparently it's picking up an update of the maven-clean-plugin but it's not reporting about an update for the maven-dependency-plugin as one would expect because of the manual downgrade via the sed command.

If you mean with "Unable to reproduce" the fact that you don't get the message [INFO] All plugins with a version specified are using the latest versions., you need to update the maven-clean-plugin to version 3.5.0. In the reproduction steps above I've added an extra sed command to do this update. I you execute the steps exactly you will get the following output:

-> git clone https://gitlab.com/philippedn/jptb.git
Cloning into 'jptb'...
remote: Enumerating objects: 147, done.
remote: Counting objects: 100% (147/147), done.
remote: Compressing objects: 100% (86/86), done.
remote: Total 147 (delta 63), reused 122 (delta 48), pack-reused 0 (from 0)
Receiving objects: 100% (147/147), 48.75 KiB | 9.75 MiB/s, done.
Resolving deltas: 100% (63/63), done.
-> cd jptb
-> sed -i 's/3\.8\.1/3.8.0/' plugin-management.xml # will downgrade maven-dependency-plugin from 3.8.1 to 3.8.0
-> sed -i 's/3\.4\.1/3.5.0/' plugin-management.xml # see https://github.com/mojohaus/versions/issues/1239#issuecomment-3263826152
-> ./mvnw versions:display-plugin-updates
[INFO] Scanning for projects...
[INFO]
[INFO] ---------------------------------------------------< com.example:jptb >---------------------------------------------------
[INFO] Building jptb 2.0.3
[INFO]   from pom.xml
[INFO] ---------------------------------------------------------[ jar ]----------------------------------------------------------
[INFO]
[INFO] --- versions:2.18.0:display-plugin-updates (default-cli) @ jptb ---
[INFO]
[INFO] All plugins with a version specified are using the latest versions.
[INFO]
[WARNING] The following plugins do not have their version specified:
[WARNING]   maven-clean-plugin ...................... (from super-pom) 3.5.0
[WARNING]   maven-compiler-plugin .................. (from super-pom) 3.14.0
[WARNING]   maven-dependency-plugin ................. (from super-pom) 3.8.1
[WARNING]   maven-deploy-plugin ..................... (from super-pom) 3.1.4
[WARNING]   maven-enforcer-plugin ................... (from super-pom) 3.6.1
[WARNING]   maven-install-plugin .................... (from super-pom) 3.1.4
[WARNING]   maven-jar-plugin ........................ (from super-pom) 3.4.2
[WARNING]   maven-resources-plugin .................. (from super-pom) 3.3.1
[WARNING]   maven-surefire-plugin ................... (from super-pom) 3.5.3
[WARNING]   org.codehaus.mojo:exec-maven-plugin ..... (from super-pom) 3.5.1
[WARNING]   org.codehaus.mojo:versions-maven-plugin  (from super-pom) 2.19.0
[INFO]
[INFO] Project requires minimum Maven version for build of: 4.0.0-rc-1
[INFO] Plugins require minimum Maven version of: 3.6.3
[INFO] Note: the super-pom from Maven 4.0.0-rc-3 defines some of the plugin
[INFO]       versions and may be influencing the plugins required minimum Maven
[INFO]       version.
[INFO]
[INFO] No plugins require a newer version of Maven than specified by the pom.
[INFO]
[INFO] --------------------------------------------------------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] --------------------------------------------------------------------------------------------------------------------------
[INFO] Total time:  2.628 s
[INFO] Finished at: 2025-09-07T16:44:55+02:00
[INFO] --------------------------------------------------------------------------------------------------------------------------

[andrzejj0]

I guess the extension is crucial to reproducing the problem, and the problem is very related to the extension. Haven't looked at the part of the Versions which is responsible for this, but I suspect that it is caused by the plugin simply parsing the project file (usually just the pom.xml) and deciding on the available updates. We do not use Maven for that, so it will also not use the extension. I guess that will be hard to fix.