Skip to content

Fix #12086: filter transitive repos and deps with uninterpolated expressions#12088

Open
gnodet wants to merge 1 commit into
masterfrom
opaque-earth
Open

Fix #12086: filter transitive repos and deps with uninterpolated expressions#12088
gnodet wants to merge 1 commit into
masterfrom
opaque-earth

Conversation

@gnodet
Copy link
Copy Markdown
Contributor

@gnodet gnodet commented May 18, 2026

Summary

  • Filter out repositories with uninterpolated IDs or URLs from ArtifactDescriptorResult after populateResult() in DefaultArtifactDescriptorReader
  • Also filter dependencies and managed dependencies with uninterpolated groupId/artifactId/version
  • Defense-in-depth on top of the mergeRepositories filter in DefaultModelBuilder (PR Filter transitive repositories with uninterpolated IDs #12050), catching entries that reach the artifact descriptor reader through any code path

Fixes #12086

Test plan

  • mvn test passes in impl/maven-impl
  • mvn test passes in compat/maven-resolver-provider
  • Verify with apache/opennlp-sandbox build (the reproducer from the issue)

gnodet added a commit that referenced this pull request May 18, 2026
Extend the uninterpolated expression filtering to also cover
repositories from transitive dependency POMs. This prevents
build failures when a transitive dependency defines a repository
with a property expression (e.g., ${eclipseP2RepoId}) as its ID
that is only available in the original project context.

Cherry-picked and adapted from PR #12088 for the 4.0.x branch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet added a commit that referenced this pull request May 19, 2026
Extend the uninterpolated expression filtering to also cover
repositories from transitive dependency POMs. This prevents
build failures when a transitive dependency defines a repository
with a property expression (e.g., ${eclipseP2RepoId}) as its ID
that is only available in the original project context.

Cherry-picked and adapted from PR #12088 for the 4.0.x branch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet added a commit that referenced this pull request May 19, 2026
Extend the uninterpolated expression filtering to also cover
repositories from transitive dependency POMs. This prevents
build failures when a transitive dependency defines a repository
with a property expression (e.g., ${eclipseP2RepoId}) as its ID
that is only available in the original project context.

Cherry-picked and adapted from PR #12088 for the 4.0.x branch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet added a commit that referenced this pull request May 19, 2026
Extend the uninterpolated expression filtering to also cover
repositories from transitive dependency POMs. This prevents
build failures when a transitive dependency defines a repository
with a property expression (e.g., ${eclipseP2RepoId}) as its ID
that is only available in the original project context.

Cherry-picked and adapted from PR #12088 for the 4.0.x branch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…essions

After populateResult() in DefaultArtifactDescriptorReader, filter out
repositories with uninterpolated IDs/URLs and dependencies with
uninterpolated groupId/artifactId/version. This is defense-in-depth
on top of the mergeRepositories filter in DefaultModelBuilder
(commit 9332ad3), catching entries that reach the artifact
descriptor reader through any code path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet added a commit that referenced this pull request May 20, 2026
…essions (#12097)

* Filter transitive dependencies with uninterpolated expressions

When a transitive dependency POM contains dependencies with
uninterpolated property expressions (e.g., ${osgi.version}), the
MavenValidator.validateDependency() throws IllegalArgumentException
during dependency collection.

Filter out such dependencies in DefaultArtifactDescriptorReader after
populateResult() runs, before they reach the resolver/validator,
following the same pattern used for transitive repositories with
uninterpolated IDs/URLs (commit 9332ad3).

This is safe because invalid dependencies from build POMs have already
been rejected during model validation. Uninterpolated expressions in
transitive dependency POMs indicate undefined properties in those
third-party POMs that cannot be resolved.

Cherry-pick of #12084, adapted for the 4.0.x delegate pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Fix #12086: filter transitive repos with uninterpolated expressions

Extend the uninterpolated expression filtering to also cover
repositories from transitive dependency POMs. This prevents
build failures when a transitive dependency defines a repository
with a property expression (e.g., ${eclipseP2RepoId}) as its ID
that is only available in the original project context.

Cherry-picked and adapted from PR #12088 for the 4.0.x branch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
gnodet added a commit that referenced this pull request May 20, 2026
…12098)

Extend the uninterpolated expression filtering to also cover
repositories from transitive dependency POMs. This prevents
build failures when a transitive dependency defines a repository
with a property expression (e.g., ${eclipseP2RepoId}) as its ID
that is only available in the original project context.

Cherry-picked and adapted from PR #12088 for the 4.0.x branch.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Transitive dependency POMs with uninterpolated repository IDs cause build failures

2 participants