Maven "Blocked mirror for repositories" (HTTP) - Fix in Maven 3.8+
Maven 3.8.1+ blocks plain http:// external repositories by default for security. A POM or settings that still points at an insecure URL is rejected with Blocked mirror for repositories.
What this error means
After upgrading to Maven 3.8+, resolution fails with Blocked mirror for repositories: [... (http://...)] even though the same POM worked on older Maven. The repo URL uses http://, not https://.
[ERROR] Failed to execute goal ... Could not resolve dependencies ...:
Blocked mirror for repositories: [maven-default-http-blocker
(http://0.0.0.0/, default, releases+snapshots)]Common causes
Insecure http:// repository URL
Maven 3.8.1 added a default mirror that blocks all external http:// repositories. Any repo declared with an http URL is refused.
A plugin or transitive POM references an http repo
Even if your POM is clean, an inherited parent or a plugin can declare an http:// repository that triggers the block.
How to fix it
Switch the repository to HTTPS
Almost every public repo serves HTTPS. Update the URL to the secure endpoint.
<repository>
<id>example</id>
<url>https://repo.example.com/maven2/</url>
</repository>Whitelist a trusted internal http repo if unavoidable
For an internal repo that genuinely has no HTTPS, add an explicit mirror so it is not caught by the blocker.
<mirror>
<id>internal-http</id>
<mirrorOf>internal-repo</mirrorOf>
<url>http://nexus.internal/repository/maven-public/</url>
<blocked>false</blocked>
</mirror>How to prevent it
- Use HTTPS URLs for every declared repository and mirror.
- Audit inherited parents and plugins for stray http:// repos before upgrading Maven.
- Front internal artifacts with an HTTPS-terminating proxy.