Why does Maven2 check for updates of stax-ex at every build?

Question

Maven2 checks for updates of stax-ex at every build. And it's just checking this single dependency, all other dependencies are updated only once per day.

Maven2 output:

artifact org.jvnet.staxex:stax-ex: checking for updates from java.net

stax-ex (groupid: org.jvnet.staxex, version: 1.2) is included as part of jaxws-rt (groupid: com.sun.xml.ws, version: 2.1.3). We have an artifactory repository as intermediary.

What could I do? ( Building offline would be an unpopular work-around.)

Answer 1

It looks like you have remote repository declarations in your POMs that bypass your enterprise repository. If you are using Artifactory you can either have remote repository references in POMs automatically stripped off on a virtual repository level, or configure mirror-any in your settings to enforce artifact resolution go strictly through your Artifactory.

Answer 2

I had the same problem, and wanted to get to the bottom of it!

The problem is in the pom.xml file of streambuffer (a dependency of jaxws-rt), which doesn't specify a version for stax-ex. Instead, it uses RELEASE, meaning the latest released version:

<dependency>
  <groupId>org.jvnet.staxex</groupId>
  <artifactId>stax-ex</artifactId>
  <version>RELEASE</version>
</dependency>

This forces Maven to check constantly for the latest release of stax-ex (even if jaxws-rt itself requests version 1.2), by downloading its corresponding maven-metadata.xml.

An easy workaround is to force the version of stax-ex in a dependencyManagement section of your pom.xm:

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.jvnet.staxex</groupId>
      <artifactId>stax-ex</artifactId>
      <version>1.2</version>
    </dependency>
  </dependencies>
</dependencyManagement>

And then Maven will stop bothering you about this warning...