Pankraz76 opened a new pull request, #13882: URL: https://github.com/apache/maven/pull/13882
The generated MavenStaxReader verified that child elements share the root element's namespace, but never validated the root namespace itself, so <project xmlns="https://ff.com";> was accepted. When the existing (previously unused) `enforceNamespace` template parameter is set, reader-stax.vm now emits the list of accepted root namespaces, derived from the model's XmlModelMetadata for every model version between `minimalVersion` and the generated version (nothing is hardcoded in the shared template). In strict mode, a root element in any other namespace is rejected; no namespace remains allowed. Only the POM reader sets `enforceNamespace`, so readers for settings, toolchains, metadata, plugin descriptors, lifecycles and extensions are unchanged. Lenient reads are unaffected, so POMs consumed from remote repositories keep working; project POMs fail with a "Malformed POM" error. Fixes #10985 Claude-Session: https://claude.ai/code/session_01MTr23zm3fn7Y3i8UGg5Lvi <!-- Please open pull requests against one of the following branches: - master — default target for all changes (new features + bug fixes). If the change should also go to maven-4.0.x, request a backport in the PR. - maven-3.10.x — target for 3.x changes (new features + bug fixes). If the change should also go to maven-3.9.x, request a backport in the PR. maven-3.9.x should receive only serious bug fixes, as it is approaching EOL. Backports are typically handled by maintainers; however, after agreement you may open a separate backport PR to the target maintenance branch. --> <!-- Add your description here... what, why and how you resolve the issue --> --- To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0) check one of the following: - [ ] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0) - [ ] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
