gnodet opened a new pull request, #701: URL: https://github.com/apache/maven-deploy-plugin/pull/701
## Summary Backports the directly portable security audit findings from the Maven 4 API master branch to the 3.x maintenance line (Maven 3 API): - **f004** (MEDIUM): deployAtEnd state machine — mark `DEPLOYED` after batch to prevent re-deploy on reactor re-entry - **f005** (MEDIUM): deployAtEnd synchronization — `DEPLOY_AT_END_LOCK` monitor prevents double-fire under `-T` - **f006** (MEDIUM): deployAtEnd javadoc — replace false atomicity claim with accurate non-atomicity description - **f007** (LOW): fail-closed skip — unrecognised `skip` values now fail instead of silently deploying; version-aware reordering - **f008** (LOW): snapshot fallback — warn when release project has only `altSnapshotDeploymentRepository` configured - **f010** (LOW): URL redaction — mask userinfo in log messages - **f012** (LOW): parse hardening — reject empty id/url in alt-repo syntax ### Findings NOT backported - **f001-f003, f009, f011, f013-f015**: Maven 4 API only (use `Session`, `ProducedArtifact`, `Path`) - **f016**: `!deployAtEnd` branch doesn't log on 3.x — nothing to invert ### API adaptation notes - Uses `ArtifactUtils.isSnapshot()` instead of Maven 4's `session.isVersionSnapshot()` - Uses `MojoExecutionException` instead of `MojoException` - Uses `File` instead of `Path` - `SkipMode` enum and `parseSkipMode()` placed in `DeployMojo` (reused by `DeployFileMojo`) - `redactUrlUserInfo()` placed in `DeployMojo` ## Test plan - [x] Unit tests pass (28/28, 0 failures) - [ ] CI integration tests pass (maven-invoker-plugin ITs) - [ ] `deployfile-release-skip` IT updated for version-aware skip reordering - [ ] `deployfile-snapshot-skip` IT updated for version-aware skip reordering Companion to master PRs: #698, #699, #700 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
