gnodet opened a new pull request, #13000:
URL: https://github.com/apache/maven/pull/13000
## Summary
Fixes #12987 — `ConcurrentModificationException` in BND/maven-bundle-plugin
during dependency resolution under Maven 4.
### Root Cause
BND's `Jar.putResource()` (bndlib ≤ 5.0.0) uses `TreeMap.computeIfAbsent()`
with a mapping function that **modifies the same TreeMap** — it adds ancestor
directory entries inside the mapping function:
```java
// aQute.bnd.osgi.Jar.putResource() — bndlib 4.0.0, line 259
Map<String, Resource> s = directories.computeIfAbsent(getDirectory(path),
dir -> {
for (int n = dir.lastIndexOf('/'); n > 0; n = dir.lastIndexOf('/')) {
dir = dir.substring(0, n);
if (directories.containsKey(dir)) break;
directories.put(dir, null); // ← modifies the same TreeMap!
}
return new TreeMap<>();
});
```
This violates the `computeIfAbsent()` contract. JDK 17.0.13+ backported
explicit CME detection for `TreeMap.computeIfAbsent()`
([JDK-8259535](https://bugs.openjdk.org/browse/JDK-8259535)), which correctly
rejects this self-modification pattern. Since Maven 4 requires JDK 17+, all
Maven 4 users hit this with old BND versions.
The bug was fixed in bndlib 5.1.0
([FELIX-6259](https://issues.apache.org/jira/browse/FELIX-6259), [BND PR
#3904](https://github.com/bndtools/bnd/pull/3904)).
### What This PR Does
- Catches `ConcurrentModificationException` specifically in
`DefaultBuildPluginManager.executeMojo()`
- Detects the known BND stack trace pattern
(`aQute.bnd.osgi.Jar.putResource`)
- Provides a clear, actionable error message:
- Identifies the root cause (FELIX-6259 + JDK-8259535)
- Suggests upgrading `maven-bundle-plugin` to 5.1.9+ or `bnd-maven-plugin`
to 6.0.0+
- For non-BND CMEs, provides general guidance about `computeIfAbsent()`
issues on newer JDKs
- Adds unit tests for the detection logic
### Before (cryptic error)
```
[ERROR] Failed to execute goal
org.apache.felix:maven-bundle-plugin:4.0.0:bundle
on project geronimo-metrics-common:
Execution default-bundle of goal ... failed.
ConcurrentModificationException
```
### After (actionable diagnostic)
```
[ERROR] Failed to execute goal
org.apache.felix:maven-bundle-plugin:4.0.0:bundle
on project geronimo-metrics-common:
Execution default-bundle of goal ... failed:
ConcurrentModificationException.
This is a known bug in bndlib versions prior to 5.1.0 (FELIX-6259):
BND's Jar.putResource() modifies a TreeMap inside its own
computeIfAbsent() call,
which JDK 17.0.13+ now correctly detects (JDK-8259535).
To fix this, upgrade maven-bundle-plugin to 5.1.9+ or bnd-maven-plugin to
6.0.0+.
```
### Affected Projects
All 7 projects identified in #12987 use old BND versions (bndlib
4.0.0–4.3.0) that predate the fix:
| Project | Plugin | BND Version |
|---------|--------|-------------|
| geronimo-health | maven-bundle-plugin 4.0.0 | bndlib 4.0.0 |
| geronimo-metrics | maven-bundle-plugin 4.0.0 | bndlib 4.0.0 |
| geronimo-opentracing | maven-bundle-plugin 4.1.0 | bndlib 4.1.0 |
| geronimo-config | maven-bundle-plugin 4.2.1 | bndlib ~4.3.0 |
| geronimo-jcache-simple | maven-bundle-plugin 4.2.1 | bndlib ~4.3.0 |
| aries-journaled-events | bnd-maven-plugin 4.1.0 | bndlib 4.1.0 |
| aries-tx-control | bnd-maven-plugin 4.1.0 | bndlib 4.1.0 |
## Test plan
- [x] Unit tests for BND CME detection logic (3 tests)
- [x] All existing maven-core tests pass (643 tests)
- [x] Spotless formatting check passes
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
