Maven 3.10.x should use Maven 3.1 validation in strict mode

[gnodet]

Changes VALIDATION_LEVEL_STRICT from VALIDATION_LEVEL_MAVEN_3_0 (30) to VALIDATION_LEVEL_MAVEN_3_1 (31).

In strict mode (the default for project builds), the getSeverity(request, errorThreshold) method returns ERROR when validationLevel >= threshold and WARNING otherwise. By raising the strict level from 3.0 to 3.1, the following checks are promoted from warnings to errors:

• Duplicate plugin declarations in build/plugins
• Banned characters in version strings (e.g. backslash, expression fragments)
• Unsupported snapshot version formats (non-standard SNAPSHOT qualifiers)
• Banned characters in repository IDs
• Reserved repository ID local

Additional warnings are now emitted for:

• system scope dependency deprecation
• Hard-coded system paths in systemPath
• ${basedir}-relative system paths

The test resource duplicate-plugins-merged-pom.xml was updated to move the duplicate plugin into a profile (avoiding the raw validation error while still testing plugin merge behavior).

Unit tests updated to explicitly use VALIDATION_LEVEL_MAVEN_3_0 where the test exercises pre-3.1 behavior, and to use the default (now 3.1) level where the stricter validation is expected.

Companion IT PR: apache/maven-integration-testing#441

[cstamas]

Let's see CI, as it may have some quirks...

[cstamas]

Oups, not yet, these are IT failures...

[gnodet]

Companion IT PR: apache/maven-integration-testing#441

[cstamas]

But title mentions 3.9.x...

[gnodet-bot]

The test logic and constant change are sound. VALIDATION_LEVEL_STRICT = VALIDATION_LEVEL_MAVEN_3_1 is the right move for Maven 3.10.x — the 3.1 checks (duplicate plugins, bad version chars, bad snapshot format, bad/reserved repo IDs) have been stable since Maven 3.1 (2012), and promoting them to errors in a new minor is reasonable. The test split into *30 / default variants is clean and exhaustive.

One structural concern with duplicate-plugins-merged-pom.xml (see inline).

This review was generated by an AI agent, Hermès on behalf of @gnodet.

[gnodet-bot]

Re-review after 7f77651

Previous finding — addressed ✅
The activeByDefault fragility I flagged is now fixed: the profile uses <activation><property><name>activateFooProfile</name></property></activation> (activated when the property is set, not silently deactivated by other profiles), and the test explicitly activates it via setActiveProfileIds(["foo"]). This makes testDuplicatePluginDefinitionsMerged environment-independent. Good fix.

Remaining issue — PR title is wrong
The title says "Maven 3.9.x should use Maven 3.1 validation in strict mode" but the PR targets the maven-3.10.x branch with milestone 3.10.0. 3.9.x is a distinct release line that is not the target of this change. The title should read something like "Maven 3.10.x should use Maven 3.1 validation in strict mode" (or simply "Raise VALIDATION_LEVEL_STRICT to VALIDATION_LEVEL_MAVEN_3_1 for Maven 3.10.x"). This was already noted by @cstamas and is still not updated.

Validator logic — verified ✅
The tests correctly reflect the validator's getSeverity logic:

• validateBannedCharacters and validate20ProperSnapshotVersion use errOn31 → ERROR at 3.1 strict.
• system scope deprecation warning fires unconditionally at >= 3.1 (not gated on errOn31), so testHardCodedSystemPath correctly expects 3 warnings (not errors) at strict level — the deprecation warning was new at 3.1 in the original validator, not promoted to an error.
• All six test pairs (testDuplicatePlugin30/testDuplicatePlugin, testReservedRepositoryId30/testReservedRepositoryId, testBadVersion30/testBadVersion, testBadSnapshotVersion30/testBadSnapshotVersion, testBadRepositoryId30/testBadRepositoryId, testHardCodedSystemPath, testSystemPathRefersToProjectBasedir) are complete and consistent.

Please update the PR title before merge.

This review was generated by an AI agent, Hermès on behalf of @gnodet.

[gnodet]

PR title updated to "Maven 3.10.x should use Maven 3.1 validation in strict mode" as suggested by @cstamas and noted in the re-review.