Skip to content
Latchkey

Maven "Blocked mirror for repositories" (HTTP) - Fix in Maven 3.8+

Maven 3.8.1+ blocks plain http:// external repositories by default for security. A POM or settings that still points at an insecure URL is rejected with Blocked mirror for repositories.

What this error means

After upgrading to Maven 3.8+, resolution fails with Blocked mirror for repositories: [... (http://...)] even though the same POM worked on older Maven. The repo URL uses http://, not https://.

mvn output
[ERROR] Failed to execute goal ... Could not resolve dependencies ...:
Blocked mirror for repositories: [maven-default-http-blocker
(http://0.0.0.0/, default, releases+snapshots)]

Common causes

Insecure http:// repository URL

Maven 3.8.1 added a default mirror that blocks all external http:// repositories. Any repo declared with an http URL is refused.

A plugin or transitive POM references an http repo

Even if your POM is clean, an inherited parent or a plugin can declare an http:// repository that triggers the block.

How to fix it

Switch the repository to HTTPS

Almost every public repo serves HTTPS. Update the URL to the secure endpoint.

pom.xml
<repository>
  <id>example</id>
  <url>https://repo.example.com/maven2/</url>
</repository>

Whitelist a trusted internal http repo if unavoidable

For an internal repo that genuinely has no HTTPS, add an explicit mirror so it is not caught by the blocker.

~/.m2/settings.xml
<mirror>
  <id>internal-http</id>
  <mirrorOf>internal-repo</mirrorOf>
  <url>http://nexus.internal/repository/maven-public/</url>
  <blocked>false</blocked>
</mirror>

How to prevent it

  • Use HTTPS URLs for every declared repository and mirror.
  • Audit inherited parents and plugins for stray http:// repos before upgrading Maven.
  • Front internal artifacts with an HTTPS-terminating proxy.

Frequently asked questions

What causes ""Blocked mirror for repositories""?
Maven 3.8.1 added a default mirror that blocks all external http:// repositories. Any repo declared with an http URL is refused.
How do I fix "Blocked mirror for repositories"?
Almost every public repo serves HTTPS. Update the URL to the secure endpoint.

Related guides

References

Latchkey auto-heals failures like this one - detected, fixed, and retried without you. Start free → 30-day trial · No credit card