gnodet commented on issue #13100: URL: https://github.com/apache/maven/issues/13100#issuecomment-5680389310
For the record: the repository-stripping axis (this issue) has a fix in progress at #13116 on the `maven-3.10.x` branch. What #13116 does: The `withoutRepositories()` / `.map()` stripping was applied to **all** active profiles unconditionally — regardless of *why* they activated. But #13114 already introduced a sandboxed activation context that suppresses consumer `-D` flags and file conditions before profiles even reach the injection step. The blanket strip was therefore over-broad: it discarded repositories from legitimately-active profiles (JDK/OS, `activeByDefault`, POM-declared properties) with no security benefit. The fix removes the stripping for the `externalOrigin` / `VALIDATION_LEVEL_MINIMAL` branch in both the compat stack (`DefaultModelBuilder.withoutRepositories()`) and the impl stack (`getActiveProfiles()` stripping). The `BUILD_CONSUMER` stripping (consumer POMs must not leak profile repositories into the published artifact) is unchanged. This restores the pattern raised in this issue: `project → dep1 → dep2` where `dep1` declares `dep2`'s repository inside an `activeByDefault` or JDK-activated profile. The redefinition concern (a dependency shadowing `central` with a different URL) is orthogonal and not addressed here — that is a separate WARN/FAIL policy discussion, cf. #428. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
