gnodet opened a new pull request, #13141: URL: https://github.com/apache/maven/pull/13141
Forward-port of #13116 to `master`. ## Problem The `withoutRepositories()` stripping (compat stack) and the `.map(profile -> profile.withRepositories(List.of()).withPluginRepositories(List.of()))` stripping (impl stack) were applied to **all** active profiles in the `externalOrigin` branch unconditionally — regardless of why they activated. The sandbox activation context (#13112) already suppresses consumer `-D` flags and file conditions before profiles even reach the injection step. The blanket strip was therefore over-broad: it discarded repositories from legitimately-active profiles (JDK/OS, `activeByDefault`, POM-declared `<properties>`) with no security benefit, breaking the established pattern: ``` project → dep1 → dep2 ``` where `dep1` declares `dep2`'s non-Central repository inside a JDK- or `activeByDefault`-activated profile. Discussed in #13100. ## Changes - **compat** (`maven-model-builder`): remove `withoutRepositories()` call from the profile injection loop; remove the now-dead `withoutRepositories()` helper method - **impl** (`maven-impl`): remove `.map()` repository stripping from the `externalOrigin` branch of `getActiveProfiles()`; update comment - **`BUILD_CONSUMER`** stripping is intentional and **unchanged** — consumer POMs must not leak profile repositories into the published artifact ## Notes - The redefinition concern (a dependency shadowing `central` with a different URL) is orthogonal and should be addressed separately as a WARN/FAIL policy — not via blanket stripping (#428). - Forward-port of #13116 (same fix for `maven-3.10.x`). - Stacks cleanly on top of or independently of #13112 (the sandbox activation context PR). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
