slachiewicz commented on PR #12949: URL: https://github.com/apache/maven/pull/12949#issuecomment-5471972405
Related work in `maven-resolver`, for reviewer awareness: apache/maven-resolver#2087 adds the same kind of component checking one layer down — `PathUtils.validatePathComponent` gains `:` rejection, and a new `validateDotSeparatedPathComponent` covers group ids that get dot-expanded into path segments. The overlap is deliberate for now. This PR checks in Maven because the pinned resolver does not, and a Maven line only picks up the resolver-side change when its `resolverVersion` moves — this line currently pins 2.0.22, and 4.0.0-rc-7 is expected to pin 2.0.23, which would include #2087. Worth a reviewer decision on whether the check should stay in both places once that pin lands, or move down to the resolver. *This comment was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
