Inconsistency between report and display-plugin-updates

[wlfbck]

I'm using Maven 3.9.11. When running mvn versions:display-plugin-updates i'm (mostly) getting the correct updates:

[INFO] Require Maven 3.6.3 to use the following plugin updates:
[INFO]   com.github.spotbugs:spotbugs-maven-plugin ................. 4.9.3.2
[INFO]   maven-clean-plugin .......................................... 3.5.0
[INFO]   maven-compiler-plugin ...................................... 3.14.0
[INFO]   maven-dependency-plugin ..................................... 3.8.1
[INFO]   maven-project-info-reports-plugin ........................... 3.9.0
[INFO]   maven-site-plugin ............................. 3.21.0 -> 4.0.0-M16
[INFO]   maven-surefire-plugin ....................................... 3.5.3
[INFO]   org.codehaus.mojo:versions-maven-plugin .................... 2.18.0

(Unsure why it lists a 4.0 version for the site-plugin, but whatever)

Generating the report with mvn site however shows this:

Which lists that several older versions are used, which is not true. Atleast mvn dependency:resolve-plugins also only shows the latest versions being used.

Is this intended behavior?

Here is the example pom reproducing this (please excuse all the copying jars and resources around, i stripped down our normal pom):

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<groupId>test</groupId>
	<artifactId>test</artifactId>
	<version>1.0.0</version>
	<name>Test</name>
	<description>Test</description>
	<build>
		<sourceDirectory>src</sourceDirectory>
		<testSourceDirectory>test</testSourceDirectory>
		<resources>
			<resource>
				<directory>resources</directory>
				<excludes>
					<exclude>**/*.java</exclude>
				</excludes>
			</resource>
		</resources>
		<testResources>
			<testResource>
				<directory>test</directory>
				<excludes>
					<exclude>**/*.java</exclude>
				</excludes>
			</testResource>
		</testResources>
		<plugins>
			<plugin>
				<artifactId>maven-clean-plugin</artifactId>
				<version>3.5.0</version>
				<configuration>
	                <filesets>
	                    <fileset>
	                        <directory>${project.build.directory}/../jars</directory>
	                        <includes>
	                            <include>**/*</include>
	                        </includes>
	                    </fileset>
	                </filesets>
	            </configuration>
			</plugin>
			<plugin>
				<artifactId>maven-compiler-plugin</artifactId>
				<version>3.14.0</version>
				<configuration>
					<release></release>
					<source>21</source>
					<target>21</target>
					<compilerArgs>
						<!--This is in 2 lines because of bug workaround for M2E: https://github.com/eclipse-m2e/m2e-core/issues/136 -->
						<arg>--add-exports</arg>
						<arg>jdk.attach/sun.tools.attach=ALL-UNNAMED</arg>
						<arg>-h</arg>
						<arg>target/headers</arg>
						<arg>-d</arg>
						<arg>target/classes</arg>
					</compilerArgs>
				</configuration>
			</plugin>
			<plugin>
				<artifactId>maven-dependency-plugin</artifactId>
				<version>3.8.1</version>
				<executions>
					<execution>
						<phase>prepare-package</phase>
						<goals>
							<goal>copy-dependencies</goal>
						</goals>
						<configuration>
							<outputDirectory>${project.build.directory}/../jars</outputDirectory>
							<includeScope>runtime</includeScope>
						</configuration>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-surefire-plugin</artifactId>
				<version>3.5.3</version>
	        </plugin>
			<!-- Following recreates a bin folder -->
			<plugin>
		        <groupId>org.apache.maven.plugins</groupId>
		        <artifactId>maven-resources-plugin</artifactId>
		        <version>3.3.1</version>
		        <executions>
		            <execution>
		                <id>copy-resources</id>
		                <phase>package</phase>
		                <goals>
		                    <goal>copy-resources</goal>
		                </goals>
		                <configuration>
		                    <outputDirectory>${project.basedir}/bin</outputDirectory>
		                    <resources>
		                        <resource>
		                            <directory>${project.build.directory}/classes</directory>
		                            <filtering>false</filtering>
		                        </resource>
		                        <resource>
		                            <directory>${project.build.directory}/resources</directory>
		                            <filtering>false</filtering>
		                        </resource>
		                    </resources>
		                </configuration>
		            </execution>
		        </executions>
		    </plugin>
		    <!-- Only need to specify the version for these plugins, they are used by all the reporting plugins.
		    	Omitting will cause errors while generating the site! -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-project-info-reports-plugin</artifactId>
				<version>3.9.0</version>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-site-plugin</artifactId>
				<version>3.21.0</version>
			</plugin>
		</plugins>
	</build>
	<properties>
		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
	</properties>
	<reporting>
		<plugins>
			<!-- With this a spotbugs report is automatically generated when calling 'mvn site'.
				It displays the same information as the IDE plugin -->
			<plugin>
				<groupId>com.github.spotbugs</groupId>
				<artifactId>spotbugs-maven-plugin</artifactId>
				<version>4.9.3.2</version>
			</plugin>
			<!-- Generates a report about available updates to plugins and dependencies -->
			<plugin>
				<groupId>org.codehaus.mojo</groupId>
				<artifactId>versions-maven-plugin</artifactId>
				<version>2.18.0</version>
				<reportSets>
					<reportSet>
						<reports>
							<report>dependency-updates-report</report>
							<report>plugin-updates-report</report>
							<report>property-updates-report</report>
						</reports>
					</reportSet>
				</reportSets>
			</plugin>
		</plugins>
	</reporting>
</project>

[andrzejj0]

It is not intended, but it's a consequence of the fact that report and display mojos use completely different backends. What we need is probably a rewrite or a yet another refactoring job.

[andrzejj0]

This is not forgotten. The report plugin uses a much simpler algorithm. However, display-Plugin-updates also deserves a second look since it looks like it's overcomplicated and likely performes a lot of wasteful pom.xml passes, which probably can be spared or optimised. In due time, I'd like to revisit that and converge both plugins.

Display-plugin-updates remains much closer to the real state than the report plugin though.