slachiewicz opened a new pull request, #12949: URL: https://github.com/apache/maven/pull/12949
Coordinates and repository lists arriving from a resolved artifact descriptor are validated before use. - **Repository precedence.** Repositories declared by a resolved model no longer replace a same-id repository supplied by the request or session. A repository the model itself declared is still refreshed in place, for example once its URL is interpolated. - **Relocation coordinates.** Relocation `groupId`/`artifactId`/`version` are checked against the artifact-coordinate character set before a `RelocatedArtifact` is built; malformed components fail the descriptor read rather than entering resolution. A follow-up commit covers the remaining rejected character classes. - **`systemPath` scope.** `LOCAL_PATH` is attached only for descriptors belonging to the current build's own projects. Descriptors resolved from a repository no longer carry a local filesystem path. - **Metadata version tokens.** Version and snapshot-timestamp tokens read from `maven-metadata.xml` are validated before being spliced into a resolved version, so malformed metadata fails the read rather than producing a malformed coordinate. The rejection message names the field. Each change is a separate commit. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
