gnodet-bot commented on code in PR #13179:
URL: https://github.com/apache/maven/pull/13179#discussion_r4046249538
##########
impl/maven-cli/src/main/java/org/apache/maven/cling/invoker/mvnup/goals/PluginUpgradeStrategy.java:
##########
@@ -528,49 +545,106 @@ && isPropertyUsedByQuarkusBom(pomDocument,
propertyName)) {
/**
* Upgrades a property value if it represents a plugin version below the
minimum.
+ * First checks the current POM's properties, then searches other POMs in
the project
+ * (e.g., parent POMs) if the property is not found locally.
*/
private boolean upgradePropertyVersion(
Document pomDocument,
+ Map<Path, Document> pomMap,
String propertyName,
PluginUpgradeInfo upgrade,
String sectionName,
UpgradeContext context) {
- Editor editor = new Editor(pomDocument);
- Element root = editor.root();
+ // First, try the current POM's properties
+ if (upgradePropertyInDocument(pomDocument, propertyName, upgrade,
sectionName, context)) {
+ return true;
+ }
+
+ // Check if property exists in the current POM but is already at/above
minimum (no upgrade needed).
+ // In that case, skip the cross-POM search and the warning - the
property IS defined.
+ Element currentRoot = pomDocument.root();
+ Element currentProps =
currentRoot.childElement(PROPERTIES).orElse(null);
+ if (currentProps != null &&
currentProps.childElement(propertyName).isPresent()) {
+ return false; // Found in current POM, no upgrade needed
+ }
+
+ // Property not in current POM - search other POMs in the project
(e.g., parent POM)
+ for (Map.Entry<Path, Document> entry : pomMap.entrySet()) {
Review Comment:
**Bug: cross-POM search is sibling-unaware.**
The loop iterates every POM in `pomMap` other than the current one, looking
for a property to upgrade. It has no check that `otherDoc` is actually a Maven
parent of `pomDocument` — it will match any POM in the project that happens to
define the property.
Scenario that breaks this:
```
root/
pom.xml (defines nothing)
module-a/pom.xml (uses ${exec.maven.version}, doesn't define it)
module-b/pom.xml (defines
<exec.maven.version>3.1.0</exec.maven.version>)
```
When processing `module-a`, the code finds `exec.maven.version` in
`module-b` (a sibling, not a parent) and upgrades it — even though `module-a`
doesn't inherit that property from `module-b`. The property in `module-b` is
upgraded for the wrong reason, and `module-a` is left with an unresolvable
property reference.
The root POM being first in `LinkedHashMap` (insertion order) helps in the
common case, but doesn't protect against siblings. The fix is to only search
the actual Maven parent chain (which is already available from the `<parent>`
declarations), or to at minimum restrict the search to POMs whose `path` is an
ancestor directory of the current POM:
```java
// Only search POMs in ancestor directories (potential parents),
// not siblings or submodules of the current POM.
Path currentDir = /* derive from current pom path */;
for (Map.Entry<Path, Document> entry : pomMap.entrySet()) {
if (entry.getValue() == pomDocument) continue;
Path candidateDir = entry.getKey().getParent();
if (candidateDir == null || !currentDir.startsWith(candidateDir)) {
continue; // skip siblings and children
}
// ... rest of the search
}
```
This is not perfect (a parent POM could live outside the project tree), but
it eliminates the sibling-mutation class of bugs.
##########
its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh13059MvnupJarPluginUpgradeTest.java:
##########
@@ -0,0 +1,110 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.it;
+
+import java.io.File;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Integration test for GH-13059: mvnup jar-plugin upgrade target.
+ * <p>
+ * Verifies that {@code mvn --up apply} upgrades {@code maven-jar-plugin} to
+ * <strong>3.4.1</strong> — the last release before the two regressions
introduced
+ * in 3.4.2 via maven-archiver 3.6.3:
+ * <ul>
+ * <li>{@code SOURCE_DATE_EPOCH=0} / {@code 1970-01-01T00:00:00Z} timestamps
are
+ * rejected with {@code IllegalArgumentException}
+ * (apache/maven-jar-plugin#595)</li>
+ * <li>Derived {@code Automatic-Module-Name} values containing hyphens fail
+ * the build with {@code Invalid automatic module name: '...'}
+ * (apache/maven-jar-plugin#596)</li>
+ * </ul>
+ * After the upgrade, the project is built with {@code mvn package} to confirm
+ * that maven-jar-plugin 3.4.1 works correctly under Maven 4.
+ *
+ * @see <a href="https://github.com/apache/maven/pull/13059";>GH-13059</a>
+ * @since 4.0.0
Review Comment:
**Nit (carried over from prior review, still unaddressed):** `@since 4.0.0`
is still wrong. This class is being added on `maven-4.0.x` (milestone:
4.0.0-rc-7). Other ITs on this branch use `@since 4.0.0-rc-X` style. Should be:
```suggestion
* @since 4.0.0-rc-7
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
