Wrong plug-in version resolved after tycho update from 3.0.5 to 4.0.4

[marc-ernst]

Discussed in #3349

^{Originally posted by marc-ernst January 11, 2024}
I'm building osgi plugins using bnd. With tycho 3.0.5 they are resolved fine but with tycho 4.0.4 it takes first the found plug-in from the target platform instead of the one I have build before. I'm using goal "bnd-process" and it's the first module listed in the pom.
I've attached a small reproducer. Building it with tycho 3.0.5 (mvn -Dtycho-version=3.0.5 install) will output the correct version in the p2 repository plugins directory (org.freemarker_2.3.32) but with tycho 4.0.4 it takes the version from the target platform (org.freemarker_2.3.22.v20160210-1233.jar).

TYCHO3349bndfirst.zip

[marc-ernst]

We build osgi plug-ins from maven repository because in mvn repository there might be newer versions (as in eclipse repository) of this plug-in which contains security/bug fixes.