Enforce explicit plugin versions

[Tillerino]

Hi!

I recently bumped the Maven version in Nixpgks (NixOS/nixpkgs#238746) and ran into some small but annoying manual effort w.r.t. the this package. The issue is that this package is packaged using the double invocation method which unfortunately breaks if not all maven plugin versions are set explicitly.

We're extending the documentation to prevent this (NixOS/nixpkgs#238774), but I'm reaching out to fix the packages which have already been packaged. In this PR, we explicitly set the versions of a few plugins which hadn't had their versions set explicitly before and add a check with the enforcer plugin to make sure this won't accidentally break in the future.

Note that the exact versions of the plugins that you're using are not important to us and please do change them as you see fit. We only ask that you explicitly set the versions of all plugins so that downstream upgrades can run automatically.

Thank you.

(This was copy-pasta as I have a few repositories to go through. Please just ask if anything is unclear.)

[georgewfraser]

I'm not really following, can you clarify how this is relevant to my project in particular?

[Tillerino]

I can try :)

Somebody packaged java-language-server for Nix. In Nix, everything is built from source and everything is supposed to be perfectly reproducible. Inputs and outputs of all steps are hashed to make sure that nothing changes on a rebuild and to allow caching. When working with Maven, the Maven dependencies are treated as additional sources which are derived from the original source code. This includes Maven plugins.

So when the versions of the used Maven plugins are not completely determined by the package (e.g. java-language-server) and we upgrade the Maven version in Nix, the "source" (the Maven dependencies part) of the package changes which adds manual labor for a process which would otherwise be completely automated. This is what I did in the PR linked above.

So setting the versions of all Maven plugins helps us out with package Maintenance :)

(And it's also best practice according to the first article that turned up when I googled "Maven best practices", but I'd rather you do it as a favor to us 😄)