Maven 4 fails to resolve properties in repository URLs from transitive dependencies

[gnodet]

Description

Maven 4.0.0-rc-4 and Maven 4.0.0-SNAPSHOT (20251029.072531-121) fail to resolve properties in repository URLs defined in parent POMs of transitive dependencies, resulting in IllegalArgumentException: Invalid RemoteRepositories.

Environment

• Maven Version: 4.0.0-rc-4 and 4.0.0-SNAPSHOT (20251029.072531-121)
• Java Version: 21.0.9 (Eclipse Adoptium)
• OS: Linux

Steps to Reproduce

1. Create a minimal Maven project that depends on io.debezium:debezium-connector-db2:3.3.1.Final
2. Run mvn clean compile

Minimal Reproducer POM

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" 
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.apache.maven.reproducer</groupId>
    <artifactId>reproducer-debezium</artifactId>
    <version>1.0-SNAPSHOT</version>
    <packaging>jar</packaging>

    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <debezium-version>3.3.1.Final</debezium-version>
        <publish.snapshot.url>https://oss.sonatype.org/content/repositories/snapshots</publish.snapshot.url>
    </properties>

    <dependencies>
        <dependency>
            <groupId>io.debezium</groupId>
            <artifactId>debezium-connector-db2</artifactId>
            <version>${debezium-version}</version>
        </dependency>
    </dependencies>
</project>

Optional: Add .mvn/maven.config

--ignore-transitive-repositories

Expected Behavior

Maven should resolve the property ${publish.snapshot.url} from the debezium-build-parent POM and successfully resolve dependencies.

Actual Behavior

Maven 4.0.0-rc-4

[ERROR] Failed to execute goal on project reproducer-debezium: Could not collect dependencies for project org.apache.maven.reproducer:reproducer-debezium:jar:1.0-SNAPSHOT
[ERROR] java.lang.IllegalArgumentException: Invalid Version Range Request: io.debezium:debezium-parent:pom:3.3.1.Final < [central (https://repo.maven.apache.org/maven2, default, releases), central-snapshots (${publish.snapshot.url}, default, releases+snapshots)]
[ERROR] 	Caused by: Invalid Version Range Request: io.debezium:debezium-parent:pom:3.3.1.Final < [central (https://repo.maven.apache.org/maven2, default, releases), central-snapshots (${publish.snapshot.url}, default, releases+snapshots)]: Failed to collect dependencies at io.debezium:debezium-connector-db2:jar:3.3.1.Final

Maven 4.0.0-SNAPSHOT (20251029.072531-121)

[ERROR] Failed to execute goal on project reproducer-debezium: Could not collect dependencies for project org.apache.maven.reproducer:reproducer-debezium:jar:1.0-SNAPSHOT
[ERROR] java.lang.IllegalArgumentException: Invalid RemoteRepositories: [central (https://repo.maven.apache.org/maven2, default, releases), central-snapshots (${publish.snapshot.url}, default, releases+snapshots)]
[ERROR] 	Caused by: Invalid RemoteRepositories: [central (https://repo.maven.apache.org/maven2, default, releases), central-snapshots (${publish.snapshot.url}, default, releases+snapshots)]: Failed to collect dependencies at io.debezium:debezium-connector-db2:jar:3.3.1.Final

Root Cause

The property ${publish.snapshot.url} is defined in the debezium-build-parent POM (https://repo.maven.apache.org/maven2/io/debezium/debezium-build-parent/3.3.1.Final/debezium-build-parent-3.3.1.Final.pom):

<properties>
    <publish.snapshot.url>https://central.sonatype.com/repository/maven-snapshots/</publish.snapshot.url>
</properties>

<distributionManagement>
  <snapshotRepository>
    <id>central-snapshots</id>
    <name>Maven Central Snapshots</name>
    <url>${publish.snapshot.url}</url>
  </snapshotRepository>
</distributionManagement>

Maven 4 is not resolving this property when processing the repository URL, leaving it as ${publish.snapshot.url} in the error message.

Additional Notes

• Even defining the property in the reproducer POM does not fix the issue
• Using --ignore-transitive-repositories flag does not fix the issue
• Maven 3.x handles this correctly
• This issue blocks building Apache Camel with Maven 4

Workaround

None found. The only workaround is to use Maven 3.x.

Related Issues

This is one of three dependency resolution issues found when building Apache Camel with Maven 4. The other two issues (related to org.apache:apache:pom:21) appear to be fixed in the latest snapshot.