ikxeno opened a new issue, #13469:
URL: https://github.com/apache/maven/issues/13469
### Affected version
4.1.0-SNAPSHOT
### Bug description
I ran into this while working on mvnval (#13276). With Maven CLI classes on
the classpath, `ApiRunner.createSession(null, requestedRepo,
SecurityMode.NONE)` can return a Session using `~/.m2/repository` instead of
`requestedRepo`. It also has `[central, apache-snapshots]` as its remote
repositories instead of `[central]`. The reproducer used an isolated
`user.home` and no setting that overrides the local repository.
I ran the same call in 30 fresh JVMs, varying unrelated allocations before
session creation. Sixteen runs returned the mvnup Session; fourteen returned
ApiRunner's Session. Those counts describe this reproducer, not a failure rate
in normal use.
`ApiRunner` discovers providers and then requests an unqualified `Session`.
The standalone injector also registers mvnup's `@Named("mvnup")` provider under
that key. Both providers have priority 0, so sorting by priority leaves their
`HashSet` iteration order to decide which one wins.
I would expect the unqualified provider to win when priorities tie. If two
default providers still tie, the lookup should report ambiguity rather than
pick one by iteration order. mvnval corrects the returned session's repository
values after creation, but the underlying selection remains order-dependent for
other callers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
