Daniel Schmid opened MNG-8311 and commented

If a ~/.m2/settings.xml with an empty <localRepository/> element exists in Maven 4, it downloads dependencies to the current working directory as opposed to ~/.m2/repository.

Steps to reproduce:

• Create a settings.xml with the exact content from the settings.xml in the quick overview. The important part is the empty <localRepository/>.
• Run mvn verify or similar
• Observe it downloading dependencies to the current repository as opposed to ~/.m2/repository

Full reproducer using GitHub Actions: https://github.com/danthe1st/maven-repro/tree/wrong-local-repo
build log with Maven 4 (actual result): https://github.com/danthe1st/maven-repro/actions/runs/11343337296/job/31545681467

The output of mvn verify -X includes:

[DEBUG] Using local repository at /home/runner/work/maven-repro/maven-repro 

Files after mvn verify with Maven 4 (the maven.tar.gz and apache-maven-4.0.0-beta-4 directories aren't created from mvn verify):

Run ls
aopalliance
apache-maven-4.0.0-beta-4
com
commons-codec
commons-io
javax
maven.tar.gz
net
org
pom.xml
settings.template.xml
src
target

build log with Maven 3 (expected result): https://github.com/danthe1st/maven-repro/actions/runs/11343337296/job/31545681854

The output of mvn verify -X includes:

[DEBUG] Using local repository at /home/runner/.m2/repository 

Files after mvn verify with Maven 3:

Run ls
pom.xml
settings.template.xml
src
target

Affects: 4.0.0-beta-4

Attachments:

• job_logs_mvn3.txt (592.94 kB)
• job_logs_mvn4.txt (345.85 kB)
• settings.template.xml (380 bytes)

Remote Links:

• GitHub Pull Request #388
  
• GitHub Pull Request #1801
  

Backported to: 4.0.0-beta-5