includes/excludes/includesList/excludesList don't work correctly

Forgot about wiki auto-markup and I guess I can't edit the description. Here are the actual commands that the description refers to:

mvn versions:use-latest-versions -DincludesList=*:log4j:*:*:*
mvn versions:use-latest-versions -DincludesList=*:log4j
mvn versions:use-latest-versions -Dincludes=*:log4j:*:*:*
mvn versions:use-latest-versions -Dincludes=*:*:*:*:1.2.14

the mojo parameters includes and excludes are for in the pom only, i.e.

 
<plugin>
  <groupId>org.codehaus.mojo</groupId>
  <artifactId>versions-maven-plugin</artifactId>
  ...
  <configuration>
    ...
    <includes>
      <include>*:log4j:*:*:*</include>
    </includes>
    ...
  </configuration>
</plugin>

So they will do nothing from the CLI. In order to 'help' users, there are equivalent mojo parameters: includesList and excludesList which default to the properties includes and excludes respectively...

So, the long story cut short is that

mvn versions:use-latest-versions -DincludesList=*:log4j:*:*:*
mvn versions:use-latest-versions -DincludesList=*:log4j

should not work ever by design

Now the second thing is that you need to be aware of shell globbing and how to quote parameters in your shell...

For example, on most Unixes/Linuxes,

mvn versions:use-latest-versions -Dincludes=*:log4j:*:*:*

will not work as the shell will expand the *'s

you would need to either escape the shell's globbing (which gets messy) or quote the entire property setting correctly, i.e.

mvn versions:use-latest-versions "-Dincludes=*:log4j:*:*:*"

would be the correct way to quote and

mvn versions:use-latest-versions -Dincludes=\*:log4j:\*:\*:\*

would be the messier way of escaping the shell's globbing

I suspect it may be a bug in maven common artifact filters.

mvn versions:use-latest-versions "-Dincludes=*:log4j:*:*"

results in the artifact being updated correctly

[INFO] ------------------------------------------------------------------------
[INFO] Building includes-test 1.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- versions-maven-plugin:1.2:use-latest-versions (default-cli) @ includes-test ---
[INFO] Updated log4j:log4j:jar:null:1.2.14 to version 1.2.16
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS

Thanks for the tip on includesList/includes - that was just my misunderstanding. And while I was aware of how shell globbing works, I had simply forgotten about it when running these commands. Would it make sense to update the documentation to reflect this? I noticed that on pages http://mojo.codehaus.org/versions-maven-plugin/examples/advancing-dependency-versions.html and http://mojo.codehaus.org/versions-maven-plugin/examples/resolve-ranges.html (among others), there are example commands that use asterisks without quotes/escapes. As you point out, if someone attempts to copy/paste these on a Unix/Linux machine, it may not work as expected.

So the only case where there appears to be an actual bug (possibly in maven common artifact filters) is that the includes/excludes parameters appear to be expecting (at most) 4-part coordinates, not 5-part. For example, these commands work:

mvn versions:use-latest-versions "-Dincludes=*:*:*:1.2.14"
mvn versions:use-latest-versions "-Dincludes=*:*:jar:*"
mvn versions:use-latest-versions "-Dincludes=*:log4j:*:*"
mvn versions:use-latest-versions "-Dincludes=log4j:*:*:*"
mvn versions:use-latest-versions "-Dincludes=log4j:log4j:jar:1.2.14"

but these do not:

mvn versions:use-latest-versions "-Dincludes=*:*:*:*:1.2.14"
mvn versions:use-latest-versions "-Dincludes=*:*:*:*:*"
mvn versions:use-latest-versions "-Dincludes=*:log4j:*:*:*"

This would seem to indicate that the artifact filter library is not handling classifiers correctly.

The includesList parameter does not appear to work at all, no matter how many coordinates are specified. E.g., I tried running this:

mvn version:use-latest-releases "-DincludesList=org.springframework:*:*:*"

But it still ended up updating ALL dependencies.

This, however, worked, even though it technically shouldn't (since includes and excludes are for POM use only):

mvn version:use-latest-releases "-Dincludes=org.springframework:*:*:*"

Just confirmed that this is still present in versions-maven-plugin:1.3.1. Using the pom.xml given above, I see that all of the following update all dependencies in the pom.xml, not just the log4j one:

mvn versions:use-latest-versions "-DincludesList=*:log4j"
mvn versions:use-latest-versions "-DincludesList=*:log4j:*:*"
mvn versions:use-latest-versions "-DincludesList=*:log4j:*:*:*"

@Richard Eggert, the parameter includesList corresponds to the expression $

so

    mvn version:use-latest-releases "-Dincludes=org.springframework:*:*:*"

should work BY DESIGN

    mvn version:use-latest-releases "-DincludesList=org.springframework:*:*:*"

should never work

See

http://mojo.codehaus.org/versions-maven-plugin/use-latest-versions-mojo.html#excludesList
and
http://mojo.codehaus.org/versions-maven-plugin/use-latest-versions-mojo.html#includesList

The key thing to look at is the "Expression"

@Steven Bethard, see my previous comment.

@Stephen Connolly: Ahh, I see. Yes, I can confirm that everything works fine for me (in 1.3.1) with -Dincludes instead of -DincludesList. I never knew that "Expression" meant "thing you should use instead of the parameter name at the command line". Thanks!

well by fine I presume you mean when ignoring the classifiers bug that this issue is about

The description of this issue covers a bunch of stuff (the includes/includesList confusion, shell escaping, etc.). I assume that when you say "the classifier bug that this issue is about", you mean the second paragraph from Stephen Wiebe's second comment:

So the only case where there appears to be an actual bug (possibly in maven common artifact filters) is that the includes/excludes parameters appear to be expecting (at most) 4-part coordinates, not 5-part.

And to that, yes, I can also confirm that 4-part coordinates (groupId:artifactId:type:version) work but 5-part coordinates (groupId:artifactId:type:classifier:version) don't in 1.3.1.