gnodet opened a new pull request, #13155: URL: https://github.com/apache/maven/pull/13155
Backport of #13141 (master) and #13116 (maven-3.10.x) to `maven-4.0.x`. ## Problem The `withoutRepositories()` stripping (compat stack) and the `.map()` stripping (impl stack) were applied to **all** active profiles in the `externalOrigin` branch unconditionally — regardless of why they activated. The `hasFileOrPropertyOrConditionActivation` filter already suppresses file- and property-activated profiles before they reach injection. The blanket strip was therefore over-broad: it discarded repositories from legitimately-active profiles (JDK/OS, `activeByDefault`) with no security benefit, breaking the established pattern: ``` project → dep1 → dep2 ``` where `dep1` declares `dep2`'s non-Central repository inside a JDK- or `activeByDefault`-activated profile. ## Changes - **compat** (`maven-model-builder`): remove `withoutRepositories()` call from the profile injection loop; remove the now-dead `withoutRepositories()` helper method; add `TODO(#13146)` - **impl** (`maven-impl`): remove `.map()` repository stripping from the `externalOrigin` branch; update comment; add `TODO(#13146)` - **tests**: flip `noneMatch → anyMatch` for all `externalOrigin=true` assertions; add `testActiveByDefaultProfileRepositoryHonored()` with isolated fixture; rename `testDependencyPomActivatesOnlyEnvironmentIndependentProfiles` `BUILD_CONSUMER` stripping is intentional and **unchanged** — consumer POMs must not leak profile repositories into the published artifact. ## Notes - The redefinition concern (a dependency shadowing `central` with a different URL) is orthogonal and should be addressed separately as a WARN/FAIL policy — see #13146. - See also: #13116 (maven-3.10.x backport), #13141 (master). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
