gnodet opened a new pull request, #2082: URL: https://github.com/apache/maven-resolver/pull/2082
## Summary Fixes 5 findings from the maven-resolver security audit (scan-maven-resolver-20260811): | Finding | Severity | Description | |---------|----------|-------------| | f011 | MEDIUM | Metadata checksum policy silently downgraded by release/snapshot weakest-wins merge | | f012 | MEDIUM | Descriptor cache ignores repository context: poisoned POM resolution replayed build-wide | | f014 | MEDIUM | Single remote probe drops the entire prefixes dependency-confusion filter | | f015 | MEDIUM | Remote POM repository declaration downgrades mirror checksum policy to ignore | | f018 | MEDIUM | Cached not-found converts transient denial into persistent source rerouting | **Root cause:** Policy merges, filter state, negative caches, and the descriptor cache all accept remotely-influenced input as authoritative, allowing hostile POMs to silently weaken operator-configured verification controls. **Fix:** Input from a remote repository must never weaken an operator-configured verification or filtering decision. Merge strongest-wins, include repository context in cache keys, allow only verified paths instead of dropping filters. ## Test plan - [ ] Existing tests pass - [ ] Checksum policy merge uses strongest-wins - [ ] Descriptor cache is repository-aware - [ ] Prefixes filter does not drop to accept-all on single probe 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
