dependency plugin 3.9.0 now fails to respect/follow relocated module artifacts

[gemmellr]

Affected version

3.9.0

Bug description

The dependency plugin has seemingly stopped following module relocations in the 3.9.0 release. While prior 3.x releases up to 3.8.1 do successfully follow them, 3.9.0 immediately fails with an error that the artifact cant be resolved.

For example, https://repo1.maven.org/maven2/org/apache/activemq/apache-artemis/2.50.0/apache-artemis-2.50.0.pom defines a relocation to https://repo1.maven.org/maven2/org/apache/artemis/apache-artemis/2.50.0/apache-artemis-2.50.0.pom (groupId switched to org.apache.artemis as part of establishing new TLP). When this was being released, the relocation was verified to work using dependency plugin 3.8.1. Now, with 3.9.0 the same plugin execution fails.

Trying to use dependency:unpack on the tar.gz artifact with 3.9.0 seemingly ignores the relocation and fails like so:

[INFO] --- dependency:3.9.0:unpack (copy) @ testing-dependency-relocation ---
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/activemq/apache-artemis/2.50.0/apache-artemis-2.50.0-bin.tar.gz
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.815 s
[INFO] Finished at: 2026-02-06T09:55:22Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-dependency-plugin:3.9.0:unpack (copy) on project testing-dependency-relocation: Unable to find/resolve artifact.: The following artifacts could not be resolved: org.apache.activemq:apache-artemis:tar.gz:bin:2.50.0 (absent): Could not find artifact org.apache.activemq:apache-artemis:tar.gz:bin:2.50.0 in central (https://repo.maven.apache.org/maven2) -> [Help 1]

Whereas using 3.8.1 (now also tried 3.7.1, 3.6.1, and 3.0.0 to verify prior releases did similarly) then it respects the relocation and succeeds in unpacking the relocated archive:

[INFO] --- dependency:3.8.1:unpack (copy) @ testing-dependency-relocation ---
[INFO] Configured Artifact: org.apache.activemq:apache-artemis:bin:2.50.0:tar.gz
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/activemq/apache-artemis/2.50.0/apache-artemis-2.50.0.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/activemq/apache-artemis/2.50.0/apache-artemis-2.50.0.pom (1.7 kB at 7.6 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/activemq/artemis-relocations-parent/2.50.0/artemis-relocations-parent-2.50.0.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/activemq/artemis-relocations-parent/2.50.0/artemis-relocations-parent-2.50.0.pom (4.3 kB at 79 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/artemis/artemis-pom/2.50.0/artemis-pom-2.50.0.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/artemis/artemis-pom/2.50.0/artemis-pom-2.50.0.pom (38 kB at 715 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/artemis/artemis-project/2.50.0/artemis-project-2.50.0.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/artemis/artemis-project/2.50.0/artemis-project-2.50.0.pom (56 kB at 1.2 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/artemis/artemis-bom/2.50.0/artemis-bom-2.50.0.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/artemis/artemis-bom/2.50.0/artemis-bom-2.50.0.pom (18 kB at 384 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/artemis/apache-artemis/2.50.0/apache-artemis-2.50.0.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/artemis/apache-artemis/2.50.0/apache-artemis-2.50.0.pom (9.9 kB at 215 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/artemis/apache-artemis/2.50.0/apache-artemis-2.50.0-bin.tar.gz
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/artemis/apache-artemis/2.50.0/apache-artemis-2.50.0-bin.tar.gz (47 MB at 59 MB/s)
[INFO] Expanding: /path/to/.m2/repository/org/apache/artemis/apache-artemis/2.50.0/apache-artemis-2.50.0-bin.tar.gz into /path/to/test/target/apache-artemis-2.50.0-bin

Checking the local repo contents (and clearing it) between these attempts confirmed what the output already appeared to clearly demonstrate. The 3.9.0 plugin never downloads the initial module pom at all, which fits with it then failing to respect the relocation in it as it simply hasnt looked. The only file added to the local repo is .m2/repository/org/apache/activemq/apache-artemis-2.50.0-bin.tar.gz.lastUpdated under the old groupId.

In contrast, the previous 3.x plugin versions tried all do download the org.apache.activemq apache-artemis module relocation pom, and its dependent poms, then similarly grab the relocated org.apache.artemis apache-artemis module pom, and finally are able to successfully grab the tar.gz and unpack it as expected. They dont create an apache-artemis-2.50.0-bin.tar.gz.lastUpdated file at all, under either old or new groupId.