slachiewicz opened a new pull request, #12950: URL: https://github.com/apache/maven/pull/12950
Fixes on the legacy compatibility paths. - **Checksum policy.** Three legacy metadata paths ignored the configured checksum policy and defaulted to a warning regardless of a `fail` setting; the configured policy is now threaded through and honoured. - **Repository key and metadata tokens.** The repository key is validated before it becomes part of a local file name, and version tokens from downloaded metadata are validated at the single point all metadata passes through, which also covers the latest/release/snapshot transformations. - **Proxy decryption.** `DefaultSettingsDecrypter` now clones each proxy before setting its decrypted password, mirroring the existing behaviour for servers, so decryption no longer mutates the caller's settings objects. Maven 3 already clones here. Each change is a separate commit. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
