> That's by default in maven - you have to do something really stupid to get non-repeatable builds

I think they changed it now but for years the default behaviour was to get the latest versions of every plugin, making builds non-repeatable by default.