slachiewicz opened a new pull request, #12951: URL: https://github.com/apache/maven/pull/12951
Robustness fixes across the CLI, transport and consumer POM. - **Transfer listener output.** Control characters in transfer messages are escaped so they render literally rather than being interpreted by the terminal. Tab and newline are preserved. - **Transport base URI.** Relative locations resolve against a slash-terminated base, so a relative reference cannot resolve outside it. - **Mirror matching.** `isExternalRepo`/`isExternalHttpRepo` parsed with `java.net.URL`, which throws on `dav:`, `dav:http:` and `dav+http:` — leaving those branches unreachable — and returned `false` on any parse failure, so an unparseable URL matched no `external:*` mirror. Parsing is now textual and an unparseable URL is treated as external. - **Settings decryption messages.** Decryption failure messages identify the server or profile property concerned rather than including the encrypted value. - **Consumer POM repositories.** The consumer POM now publishes only repositories the project's own POM declares; those present only via a parent POM or an active `settings.xml` profile are dropped, with a warning naming each. `maven.consumer.pom.sanitizeRepositories=false` restores the previous behaviour. **This changes a published artifact format** — see the note below. - **mvnup resolution.** `mvnup` reused hardcoded repositories and forced `user.home`, so a real `settings.xml` was never read. It now uses the settings the CLI already loaded and the configured local repository. Where the standalone resolver cannot honour the configuration — offline mode, a redirecting mirror, an active proxy — it is given no remote repositories and the affected strategies skip their remote work with a warning. **Release note for the consumer POM change:** a downstream consumer relying on inheriting a repository declaration that existed only in a parent POM or the publisher's settings will need to declare that repository itself. Each change is a separate commit. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
