cstamas opened a new issue, #13100: URL: https://github.com/apache/maven/issues/13100
### New feature, improvement proposal The more I look at commit https://github.com/apache/maven/commit/03c947d820889098701021d9a99b256358fde0cd the more questions it raises: * it removes repositories from profiles. Why? And what happens with repositories defined in POM itself? Why not removing both, why only one (profile)? What differentiates them from POM defined repositories? * Maven _relies_ on POM defined repositories (they may come from profile), as there is pattern that `project -> dep1 -> dep2` where dep1 _knows_ dep2 is not on Central but is somewhere else. * What we should scrutinize is _repository redefine_ IMHO, where an existing remote repository was "redefined" (and scoped to that node and below) nb: this reminds me of https://github.com/apache/maven/pull/428 * In case of a "malicious" dependency, that may redefine a repository, it may silently redirect the build to malicious repository? * In redefine cases we may want to prevent it, or WARN on it, or maybe even have a switch like WARN/FAIL? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
