Maven 4 (rc5) fails in maven-install-plugin due to consumer POM builder not resolving BOM imports from settings.xml profile repositories

[DavidTavoularis]

Affected version

4.0.0-rc5

Bug description

Note that I asked Claude Code to help with the analysis and the fix.

$ mvn clean install
[...]
[INFO] --- install:3.1.3:install (default-install) @ xxx ---
[INFO] Artifact yyy is present in the local repository, but cached from a remote repository ID that is unavailable in current build context, verifying that is downloadable from [central (https://repo.maven.apache.org/maven2, default, releases)]
[INFO] --------------------------------------------------------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] --------------------------------------------------------------------------------------------------------------------------
[...]
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-install-plugin:3.1.3:install (default-install) on project xxx: Execution default-install of goal org.apache.maven.plugins:maven-install-plugin:3.1.3:install failed: org.apache.maven.api.services.ModelBuilderException: 12 problems were encountered while building the effective model for xxx
[ERROR]     - [ERROR] Non-resolvable import POM: The following artifacts could not be resolved: yyy (present, but unavailable): yyy was not found in https://repo.maven.apache.org/maven2 during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced (remote repositories: central (https://repo.maven.apache.org/maven2, default, releases)) @ line 22, column 7
[...]

In DefaultProjectBuilder (normal build), the ModelBuilderRequest is constructed with:

• repositories(...) — passes remote repositories (including those from settings.xml profiles)
• profiles(...) — passes profiles (from settings.xml)
• activeProfileIds(...) — passes active profile IDs

In DefaultConsumerPomBuilder.buildModel() (used during install/deploy), none of these are set:
  // Line 225-238 - DefaultConsumerPomBuilder.java
  private ModelBuilderResult buildModel(RepositorySystemSession session, ModelSource src) {
      InternalSession iSession = InternalSession.from(session);
      ModelBuilderRequest.ModelBuilderRequestBuilder request = ModelBuilderRequest.builder();
      request.requestType(ModelBuilderRequest.RequestType.BUILD_CONSUMER);
      request.session(iSession);
      request.source(src);
      request.locationTracking(false);
      request.systemProperties(session.getSystemProperties());
      request.userProperties(session.getUserProperties());
      request.lifecycleBindingsInjector(lifecycleBindingsInjector::injectLifecycleBindings);
      // *** MISSING: request.repositories(...) ***
      // *** MISSING: request.profiles(...) ***
      // *** MISSING: request.activeProfileIds(...) ***
      ...
  }

The buildModel method at DefaultConsumerPomBuilder.java:225 never calls request.repositories(), request.profiles(), or request.activeProfileIds(). So when the model builder resolves BOM imports, it only has Maven Central — the private repository from your settings.xml profile is never injected.

The bug was actually in two places:

1. DefaultConsumerPomBuilder.buildModel() - wasn't passing repositories/profiles to the ModelBuilderRequest at all
2. DefaultModelBuilder.derive() - even when repositories were passed in the request, the derive() method ignored them and reused the parent session's repositories

Claude Code updated the 2 following unitary tests (which failed without the 2 fixes):
Test 1: ConsumerPomBuilderTest.testConsumerPomPassesProjectRepositoriesToModelBuilder (maven-core)

• Covers the DefaultConsumerPomBuilder.buildModel() fix
• Verifies that project remote repositories are passed to the ModelBuilderRequest when building the consumer POM
• Uses Mockito spy to capture and assert on the BUILD_CONSUMER request

Test 2: DefaultModelBuilderTest.testDeriveSessionUsesRequestRepositories (maven-impl)

• Covers the DefaultModelBuilder.derive() fix
• Verifies that when a derived session is created with explicit repositories, those repos are used instead of the parent session's
• Uses reflection (same pattern as existing testMergeRepositories) to inspect the derived session's repositories and externalRepositories fields

Claude Code also created an integration test MavenITConsumerPomBomFromSettingsRepoTest:

• End-to-end: install with flattening, BOM from settings.xml profile repo, consumer -> POM has resolved versions

I was also able to confirm that when implementing the same fixes on top of 4.0-rc5, my "mvn clean install" passed.

I am now preparing a Pull Request.