Skip to content

Add regression test for PathSelector false-positive (#12617) - #12618

Closed
gnodet wants to merge 601 commits into
maven-4.0.xfrom
add-a-regression-test-for-12617-as-hitned-by-http
Closed

Add regression test for PathSelector false-positive (#12617)#12618
gnodet wants to merge 601 commits into
maven-4.0.xfrom
add-a-regression-test-for-12617-as-hitned-by-http

Conversation

@gnodet

@gnodet gnodet commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Cherry-picks the fix from Remove erroneous optimization which was skipping the path normalization. #12617 (by @desruisseaux) which removes an erroneous optimization in PathSelector that skipped path relativization when all patterns started with **
  • Adds a regression test for the exact false-positive scenario: when the base directory path contains a segment matching a ** pattern (e.g., base = something/target/test-classes with pattern **/test-classes/**), files outside the matching child directory were incorrectly matched

The test verifies:

  • A file inside a test-classes/ child directory is correctly matched
  • A file in an other/ sibling directory is not falsely matched just because the base directory path contains test-classes

Test plan

  • PathSelectorTest.testNoFalsePositiveWhenBaseDirectoryMatchesPattern fails without the fix (confirmed false positive)
  • All 6 PathSelectorTest tests pass with the fix applied
  • CI passes

🤖 Generated with Claude Code

slawekjaranowski and others added 30 commits March 14, 2026 16:05
@slawekjaranowski
Maven 3.9.13, 3.9.14 - update doap file
1b95e37
@dependabot
Bump mockitoVersion from 5.22.0 to 5.23.0 (#11792)
fa4d9db 
Bumps `mockitoVersion` from 5.22.0 to 5.23.0.

Updates `org.mockito:mockito-bom` from 5.22.0 to 5.23.0
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.22.0...v5.23.0)

Updates `org.mockito:mockito-junit-jupiter` from 5.22.0 to 5.23.0
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.22.0...v5.23.0)

---
updated-dependencies:
- dependency-name: org.mockito:mockito-bom
  dependency-version: 5.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.mockito:mockito-junit-jupiter
  dependency-version: 5.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump org.codehaus.mojo:extra-enforcer-rules from 1.11.0 to 1.12.0 (#1…
166178e 
…1803)

Bumps [org.codehaus.mojo:extra-enforcer-rules](https://github.com/mojohaus/extra-enforcer-rules) from 1.11.0 to 1.12.0.
- [Release notes](https://github.com/mojohaus/extra-enforcer-rules/releases)
- [Commits](mojohaus/extra-enforcer-rules@1.11.0...1.12.0)

---
updated-dependencies:
- dependency-name: org.codehaus.mojo:extra-enforcer-rules
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cstamas
Type derive (simpler) (#11380)
46cf946 
Instead to "smear" this feature across Maven and Resolver classes, for start let's keep it "confined" with single class: the TypeDeriver.

Later we can see where to go further with it.

This PR also includes bugfix, where Maven `DefaultType` implements `ArtifactType`, while in reality it does not (violates contract by returning `null` when no classifier present).
@slawekjaranowski
Use Maven 3.9.14 in unit test
29b3efb
@jafarre-bi
Fixes issue #11827 - Maven DI crashes if the file org.apache.maven.ap…
1867737 
…i.di.Inject contains empty lines (#11828)

* Fixes issue #11827

* Use Java 17 features

* Issue #11827 - Trim each read line to avoid related errors
@dependabot
Bump jlineVersion from 3.30.6 to 4.0.9 (#11831)
d4447e4 
Bumps `jlineVersion` from 3.30.6 to 4.0.9.

Updates `org.jline:jline-reader` from 3.30.6 to 4.0.9
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.6...4.0.9)

Updates `org.jline:jline-style` from 3.30.6 to 4.0.9
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.6...4.0.9)

Updates `org.jline:jline-builtins` from 3.30.6 to 4.0.9
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.6...4.0.9)

Updates `org.jline:jline-console` from 3.30.6 to 4.0.9
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.6...4.0.9)

Updates `org.jline:jline-console-ui` from 3.30.6 to 4.0.9
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.6...4.0.9)

Updates `org.jline:jline-terminal` from 3.30.6 to 4.0.9
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.6...4.0.9)

Updates `org.jline:jline-terminal-ffm` from 3.30.6 to 4.0.9
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.6...4.0.9)

Updates `org.jline:jline-terminal-jni` from 3.30.6 to 4.0.9
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.6...4.0.9)

Updates `org.jline:jline-native` from 3.30.6 to 4.0.9
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.6...4.0.9)

Updates `org.jline:jansi-core` from 3.30.6 to 4.0.9
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.6...4.0.9)

---
updated-dependencies:
- dependency-name: org.jline:jline-reader
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: org.jline:jline-style
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: org.jline:jline-builtins
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: org.jline:jline-console
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: org.jline:jline-console-ui
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: org.jline:jline-terminal
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: org.jline:jline-terminal-ffm
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: org.jline:jline-terminal-jni
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: org.jline:jline-native
  dependency-version: 4.0.9
  dependency-type: direct:development
  update-type: version-update:semver-major
- dependency-name: org.jline:jansi-core
  dependency-version: 4.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/cache from 5.0.3 to 5.0.4 (#11811)
76a7c7e 
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.3 to 5.0.4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@cdf6c1f...6682284)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/download-artifact from 8.0.0 to 8.0.1 (#11788)
f8c87e3 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@70fc10c...3e5f45b)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@slawekjaranowski
Maven 3.10.x - protect branch, dependabot config
23416ca
@slawekjaranowski
Maven 3.10.x add info to README
add3c9d
@mariuszs
fix: preserve processor path types across conflict resolution (#11805)
ea308a5 
When a dependency is both a direct dep (e.g., modular-jar) and a
transitive dep of a processor, ConflictResolver removes the transitive
occurrence before TypeDeriver can assign processor path types.
This causes the artifact to appear only on --module-path, not on
--processor-module-path (maven-compiler-plugin#1039).

Fix: two-phase approach without changing maven-resolver:
- TypeCollector runs BEFORE ConflictResolver, records which artifacts
  are transitive deps of processors in the transformation context
- TypeDeriver (after ConflictResolver) reads the context and sets
  PROCESSOR_TYPE property on surviving nodes that need both paths
- DefaultDependencyResolverResult reads PROCESSOR_TYPE and adds the
  artifact to processor paths as well

TypeCollector short-circuits when no processor-type direct deps exist,
so the vast majority of builds pay zero cost.
@slawekjaranowski
Add branch maven-2.2.x to protected list
7c1e47a
@slawekjaranowski
update pull request template with target branch guidelines (#11861)
44e7fea 
* update pull request template with target branch guidelines

What changed:
- Added a comment section specifying accepted target branches.
- Clarified the purpose of each target branch in the template.

Why:
- To provide clear guidance for contributors on where to direct their pull requests.
- To streamline the contribution process and reduce confusion regarding branch usage.
@dependabot
Bump net.bytebuddy:byte-buddy from 1.18.7 to 1.18.8 (#11871)
cccb63a 
Bumps [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) from 1.18.7 to 1.18.8.
- [Release notes](https://github.com/raphw/byte-buddy/releases)
- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)
- [Commits](raphw/byte-buddy@byte-buddy-1.18.7...byte-buddy-1.18.8)

---
updated-dependencies:
- dependency-name: net.bytebuddy:byte-buddy
  dependency-version: 1.18.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump org.codehaus.woodstox:stax2-api from 4.2.2 to 4.3.0 (#11870)
f8561f6 
Bumps [org.codehaus.woodstox:stax2-api](https://github.com/FasterXML/stax2-api) from 4.2.2 to 4.3.0.
- [Commits](FasterXML/stax2-api@stax2-api-4.2.2...stax2-api-4.3.0)

---
updated-dependencies:
- dependency-name: org.codehaus.woodstox:stax2-api
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3 (#11863)
720a96b 
Bumps [org.codehaus.plexus:plexus-utils](https://github.com/codehaus-plexus/plexus-utils) from 4.0.2 to 4.0.3.
- [Release notes](https://github.com/codehaus-plexus/plexus-utils/releases)
- [Commits](codehaus-plexus/plexus-utils@plexus-utils-4.0.2...plexus-utils-4.0.3)

---
updated-dependencies:
- dependency-name: org.codehaus.plexus:plexus-utils
  dependency-version: 4.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump net.sourceforge.pmd:pmd-core from 7.22.0 to 7.23.0 (#11864)
ed79e94 
Bumps [net.sourceforge.pmd:pmd-core](https://github.com/pmd/pmd) from 7.22.0 to 7.23.0.
- [Release notes](https://github.com/pmd/pmd/releases)
- [Commits](pmd/pmd@pmd_releases/7.22.0...pmd_releases/7.23.0)

---
updated-dependencies:
- dependency-name: net.sourceforge.pmd:pmd-core
  dependency-version: 7.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump jlineVersion from 4.0.9 to 4.0.10 (#11883)
b44e444 
Bumps `jlineVersion` from 4.0.9 to 4.0.10.

Updates `org.jline:jline-reader` from 4.0.9 to 4.0.10
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.9...4.0.10)

Updates `org.jline:jline-style` from 4.0.9 to 4.0.10
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.9...4.0.10)

Updates `org.jline:jline-builtins` from 4.0.9 to 4.0.10
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.9...4.0.10)

Updates `org.jline:jline-console` from 4.0.9 to 4.0.10
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.9...4.0.10)

Updates `org.jline:jline-console-ui` from 4.0.9 to 4.0.10
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.9...4.0.10)

Updates `org.jline:jline-terminal` from 4.0.9 to 4.0.10
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.9...4.0.10)

Updates `org.jline:jline-terminal-ffm` from 4.0.9 to 4.0.10
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.9...4.0.10)

Updates `org.jline:jline-terminal-jni` from 4.0.9 to 4.0.10
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.9...4.0.10)

Updates `org.jline:jline-native` from 4.0.9 to 4.0.10
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.9...4.0.10)

Updates `org.jline:jansi-core` from 4.0.9 to 4.0.10
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.9...4.0.10)

---
updated-dependencies:
- dependency-name: org.jline:jline-reader
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-style
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-builtins
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-console
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-console-ui
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal-ffm
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal-jni
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-native
  dependency-version: 4.0.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: org.jline:jansi-core
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @slachiewicz
Bump org.codehaus.plexus:plexus-utils
459de76 
Bumps [org.codehaus.plexus:plexus-utils](https://github.com/codehaus-plexus/plexus-utils) from 3.3.0 to 4.0.3.
- [Release notes](https://github.com/codehaus-plexus/plexus-utils/releases)
- [Commits](codehaus-plexus/plexus-utils@plexus-utils-3.3.0...plexus-utils-4.0.3)

---
updated-dependencies:
- dependency-name: org.codehaus.plexus:plexus-utils
  dependency-version: 4.0.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump actions/upload-artifact from 7.0.0 to 7.0.1 (#11931)
485fa0f 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump eu.maveniverse.maven.plugins:bom-builder3 from 1.3.2 to 1.3.3 (#…
b8636bd 
…11912)

Bumps [eu.maveniverse.maven.plugins:bom-builder3](https://github.com/maveniverse/bom-builder-maven-plugin) from 1.3.2 to 1.3.3.
- [Release notes](https://github.com/maveniverse/bom-builder-maven-plugin/releases)
- [Commits](maveniverse/bom-builder-maven-plugin@release-1.3.2...release-1.3.3)

---
updated-dependencies:
- dependency-name: eu.maveniverse.maven.plugins:bom-builder3
  dependency-version: 1.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump jlineVersion from 4.0.10 to 4.0.11 (#11902)
2e18d8f 
Bumps `jlineVersion` from 4.0.10 to 4.0.11.

Updates `org.jline:jline-reader` from 4.0.10 to 4.0.11
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.10...4.0.11)

Updates `org.jline:jline-style` from 4.0.10 to 4.0.11
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.10...4.0.11)

Updates `org.jline:jline-builtins` from 4.0.10 to 4.0.11
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.10...4.0.11)

Updates `org.jline:jline-console` from 4.0.10 to 4.0.11
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.10...4.0.11)

Updates `org.jline:jline-console-ui` from 4.0.10 to 4.0.11
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.10...4.0.11)

Updates `org.jline:jline-terminal` from 4.0.10 to 4.0.11
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.10...4.0.11)

Updates `org.jline:jline-terminal-ffm` from 4.0.10 to 4.0.11
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.10...4.0.11)

Updates `org.jline:jline-terminal-jni` from 4.0.10 to 4.0.11
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.10...4.0.11)

Updates `org.jline:jline-native` from 4.0.10 to 4.0.11
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.10...4.0.11)

Updates `org.jline:jansi-core` from 4.0.10 to 4.0.11
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.10...4.0.11)

---
updated-dependencies:
- dependency-name: org.jline:jline-reader
  dependency-version: 4.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-style
  dependency-version: 4.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-builtins
  dependency-version: 4.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-console
  dependency-version: 4.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-console-ui
  dependency-version: 4.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal
  dependency-version: 4.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal-ffm
  dependency-version: 4.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal-jni
  dependency-version: 4.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-native
  dependency-version: 4.0.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: org.jline:jansi-core
  dependency-version: 4.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/cache from 5.0.4 to 5.0.5 (#11942)
77e7dc6 
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.4 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@6682284...27d5ce7)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump com.github.siom79.japicmp:japicmp-maven-plugin (#11941)
9285ab3 
Bumps [com.github.siom79.japicmp:japicmp-maven-plugin](https://github.com/siom79/japicmp) from 0.25.4 to 0.25.5.
- [Release notes](https://github.com/siom79/japicmp/releases)
- [Changelog](https://github.com/siom79/japicmp/blob/master/release.py)
- [Commits](siom79/japicmp@japicmp-base-0.25.4...japicmp-base-0.25.5)

---
updated-dependencies:
- dependency-name: com.github.siom79.japicmp:japicmp-maven-plugin
  dependency-version: 0.25.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump jlineVersion from 4.0.11 to 4.0.12 (#11940)
7830270 
Bumps `jlineVersion` from 4.0.11 to 4.0.12.

Updates `org.jline:jline-reader` from 4.0.11 to 4.0.12
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.11...4.0.12)

Updates `org.jline:jline-style` from 4.0.11 to 4.0.12
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.11...4.0.12)

Updates `org.jline:jline-builtins` from 4.0.11 to 4.0.12
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.11...4.0.12)

Updates `org.jline:jline-console` from 4.0.11 to 4.0.12
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.11...4.0.12)

Updates `org.jline:jline-console-ui` from 4.0.11 to 4.0.12
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.11...4.0.12)

Updates `org.jline:jline-terminal` from 4.0.11 to 4.0.12
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.11...4.0.12)

Updates `org.jline:jline-terminal-ffm` from 4.0.11 to 4.0.12
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.11...4.0.12)

Updates `org.jline:jline-terminal-jni` from 4.0.11 to 4.0.12
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.11...4.0.12)

Updates `org.jline:jline-native` from 4.0.11 to 4.0.12
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.11...4.0.12)

Updates `org.jline:jansi-core` from 4.0.11 to 4.0.12
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.11...4.0.12)

---
updated-dependencies:
- dependency-name: org.jline:jline-reader
  dependency-version: 4.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-style
  dependency-version: 4.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-builtins
  dependency-version: 4.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-console
  dependency-version: 4.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-console-ui
  dependency-version: 4.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal
  dependency-version: 4.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal-ffm
  dependency-version: 4.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal-jni
  dependency-version: 4.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-native
  dependency-version: 4.0.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: org.jline:jansi-core
  dependency-version: 4.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre (#11950)
6fdf4f4 
Bumps [com.google.guava:guava](https://github.com/google/guava) from 33.5.0-jre to 33.6.0-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-version: 33.6.0-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cstamas
Update to Mimir 0.11.3 (#11960)
8680371
@slawekjaranowski
Promote java version in JavaToolchain
528a0f0 
Many plugins using toolchains has requirements to detect java version selected by toolchains in runtime.

Expose java version in JavaToolchain can simplify plugins code.
@dependabot
Bump com.github.siom79.japicmp:japicmp-maven-plugin (#11961)
d573d13 
Bumps [com.github.siom79.japicmp:japicmp-maven-plugin](https://github.com/siom79/japicmp) from 0.25.5 to 0.25.6.
- [Release notes](https://github.com/siom79/japicmp/releases)
- [Changelog](https://github.com/siom79/japicmp/blob/master/release.py)
- [Commits](siom79/japicmp@japicmp-base-0.25.5...japicmp-base-0.25.6)

---
updated-dependencies:
- dependency-name: com.github.siom79.japicmp:japicmp-maven-plugin
  dependency-version: 0.25.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Hiteshsai007 and others added 28 commits July 17, 2026 13:12
@Hiteshsai007 @gnodet @claude
[MNG-8432] Integration test for mixin-based property and dependency m…
671031e 
…anagement inheritance

* Integration test for MNG-8432 using mixins

* Use maven-it-plugin-expression instead of effective POM string matching

Replace help:effective-pom + Files.readString/String.contains with the
conventional maven-it-plugin-expression approach using
verifier.loadProperties(), which is more robust against
whitespace/formatting changes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Guillaume Nodet <gnodet@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@mvanhorn
Avoid IllegalStateException on duplicate profile ids in DefaultModelB…
67a94a1 
…uilder (#12419)

Save/restore profile activations positionally instead of keyed by profile id, so POMs with duplicate profile ids (e.g. javafx <=20) no longer crash dependency collection. Duplicate-id diagnostics remain with the validator.

Fixes #10209
@gnodet @claude
fix: mvnup: widen exact Maven version pins to allow Maven 4 (#12505)
4ba3291 
Projects like Apache Flink pin their Maven version to an exact version
using ranges like [3.8.6,3.8.6] (both bounds equal, both inclusive).
The existing MAVEN4_EXCLUSIVE_UPPER_BOUND pattern only matched ranges
with an exclusive upper bound at 4.x (e.g. [3.8.8,4)), so exact pins
and ranges with an upper bound below 4 were silently skipped.

Add a new UPPER_BOUND_BELOW_MAVEN4 pattern that catches any version
range whose upper bound has a major version less than 4. This covers:
- Exact version pins: [3.8.6,3.8.6] -> [3.8.6,5)
- Sub-4 upper bounds: [3.8.0,3.9) -> [3.8.0,5)
- Unbounded lower ranges: (,3.9] -> (,5)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@dependabot @slawekjaranowski
Bump actions/checkout from 7.0.0 to 7.0.1
97dd0c6 
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@cstamas
Deps: Bump to Resolver 2.0.21 (#12509)
a2aed72 
And add more validation to MavenValidator.
@gnodet @claude
Use maven-it-plugin-expression instead of effective POM string matchi…
3ba3c0e 
…ng in MNG-11133 test (#12502)

Replace help:effective-pom + Files.readString/String.contains with the
conventional maven-it-plugin-expression approach using
verifier.loadProperties(), which is more robust against
whitespace/formatting changes.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@gnodet
Add cross-thread deadlock regression test for #12472
85f0261 
Add three regression tests for the AbstractRequestCache deadlock that
caused Maven 4.0.0-rc-5 to hang on 24 out of 966 tested Apache projects.

- testConcurrentBatchRequestsWithSharedKeyDoNotDeadlock: concurrent batch
  requests() with overlapping keys through an equals-based cache
- testConcurrentBatchRequestsWithMutatingSharedKeyDoNotDeadlock: variant
  where equals()/hashCode() mutate during resolution, mirroring mutable
  RequestTrace data — verified to deadlock on pre-fix code (by @ascheman)
- testSequentialBatchRequestsWithSharedKeyReuseResult: sequential calls
  with shared keys correctly reuse cached results

Closes #12478
@gnodet Gerd Aschemann @claude
Fix #12507: preserve unresolved ${...} in CLI -D values (Maven 3 sema…
828e528 
…ntics) (#12523)

* Add failing IT for #12507 (CLI ${...} param wipe)

MavenITgh12507CliParamNestedInterpolationTest shows that ${user.dir}
and ${project.build.directory} inside a -D-supplied plugin parameter
value are replaced with the empty string at CLI parse time
(BaseParser.populateUserProperties interpolates user-specified
properties with defaultsToEmpty=true against a paths-only callback),
while Maven 3 resolves such expressions at mojo configuration time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Fix #12507: dont wipe unresolved ${...} in -D values

BaseParser.populateUserProperties interpolated user-specified
properties with defaultsToEmpty=true against a paths-only callback,
silently replacing every expression it could not resolve (system
properties, project.* references) with the empty string. Pass
defaultsToEmpty=false so unresolved placeholders stay literal and are
evaluated later with full session/project context by the plugin
parameter expression evaluator -- restoring Maven 3 semantics for
values like -DaltDeploymentRepository=id::file://${project.build.directory}/x.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Update gh-11978 IT to expect Maven 3 semantics for unknown placeholders

The previous assertion expected unknown ${...} in CLI -D values to be
emptied, but that was an unintended side effect of #2480 (which only
meant to add session.topDirectory interpolation). Maven 3 leaves
unknown placeholders literal — update the assertion to match.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Gerd Aschemann <ascheman@apache.org>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
@elharo
Add test for prefixed Maven elements (#10971)
b646a7a 
* Add test for prefixed Maven elements
@dependabot
Bump resolverVersion from 2.0.21-SNAPSHOT to 2.0.21 (#12543)
fde9832 
Bumps `resolverVersion` from 2.0.21-SNAPSHOT to 2.0.21.

Updates `org.apache.maven.resolver:maven-resolver-api` from 2.0.21-SNAPSHOT to 2.0.21
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](https://github.com/apache/maven-resolver/commits/maven-resolver-2.0.21)

Updates `org.apache.maven.resolver:maven-resolver-spi` from 2.0.21-SNAPSHOT to 2.0.21
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](https://github.com/apache/maven-resolver/commits/maven-resolver-2.0.21)

Updates `org.apache.maven.resolver:maven-resolver-impl` from 2.0.21-SNAPSHOT to 2.0.21
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](https://github.com/apache/maven-resolver/commits/maven-resolver-2.0.21)

Updates `org.apache.maven.resolver:maven-resolver-util` from 2.0.21-SNAPSHOT to 2.0.21
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](https://github.com/apache/maven-resolver/commits/maven-resolver-2.0.21)

Updates `org.apache.maven.resolver:maven-resolver-named-locks` from 2.0.21-SNAPSHOT to 2.0.21
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](https://github.com/apache/maven-resolver/commits/maven-resolver-2.0.21)

Updates `org.apache.maven.resolver:maven-resolver-connector-basic` from 2.0.21-SNAPSHOT to 2.0.21
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](https://github.com/apache/maven-resolver/commits/maven-resolver-2.0.21)

Updates `org.apache.maven.resolver:maven-resolver-transport-file` from 2.0.21-SNAPSHOT to 2.0.21
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](https://github.com/apache/maven-resolver/commits/maven-resolver-2.0.21)

Updates `org.apache.maven.resolver:maven-resolver-transport-apache` from 2.0.21-SNAPSHOT to 2.0.21
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](https://github.com/apache/maven-resolver/commits/maven-resolver-2.0.21)

Updates `org.apache.maven.resolver:maven-resolver-transport-jdk` from 2.0.21-SNAPSHOT to 2.0.21

Updates `org.apache.maven.resolver:maven-resolver-transport-wagon` from 2.0.21-SNAPSHOT to 2.0.21
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](https://github.com/apache/maven-resolver/commits/maven-resolver-2.0.21)

Updates `org.apache.maven.resolver:maven-resolver-tools` from 2.0.21-SNAPSHOT to 2.0.21
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](https://github.com/apache/maven-resolver/commits/maven-resolver-2.0.21)

---
updated-dependencies:
- dependency-name: org.apache.maven.resolver:maven-resolver-api
  dependency-version: 2.0.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-spi
  dependency-version: 2.0.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-impl
  dependency-version: 2.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-util
  dependency-version: 2.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-named-locks
  dependency-version: 2.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-connector-basic
  dependency-version: 2.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-transport-file
  dependency-version: 2.0.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-transport-apache
  dependency-version: 2.0.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-transport-jdk
  dependency-version: 2.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-transport-wagon
  dependency-version: 2.0.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-tools
  dependency-version: 2.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cstamas
Introduce validation control (#12520)
5703b7d 
Enables validation level choice in Maven Resolver validator.

This change should go to every Maven version having `MavenValidator` (3.10, 4.0 and 4.1).

Related: apache/maven-resolver#2007
@JackMyers001
Fix #12536: Handle Ctrl+C on Windows terminals (#12538)
a3e576b 
On Windows, JLine handles Ctrl+C as the terminal's `INT` signal. Without
an explicit handler, the standalone Maven JVM does not follow its normal
interrupt termination path and Maven's shutdown hooks do not run, which
can leave long-running child processes alive.

This change registers an `INT` handler for Windows terminals that exits
with status `130`. This triggers normal JVM shutdown and its registered
cleanup hooks.
@gnodet
[MNG-8507] Reduce allocation pressure in model building pipeline
2cbce40 
Forward port of f5426bf (maven-4.0.x) to master.

Reduce allocation pressure in the Maven 4 immutable model building
pipeline, measured with JFR on Apache Camel (676 modules).
Overall allocation reduction: ~49% (from ~4,000 MB to ~2,054 MB).

Key optimizations:
- DefaultModelInterpolator: skip interpolation callback for strings
  without '$' via anonymous MavenTransformer subclass override
- DefaultModelInterpolator: share HashSet for cycle detection across
  all strings in a model, avoiding ~550 allocations per module
- DefaultInterpolator.unescape(): fast-path when no escape markers
- DefaultModelValidator: hoist scope computation before dep loop
- InternalSession.from(): instanceof fast-path before string concat
- MavenProject.hashCode(): inline hash to avoid varargs Object[]
- TypeRegistryAdapter: cache get() results in ConcurrentHashMap
- PropertiesAsMap: eliminate Entry wrapper allocation, replace
  stream().filter().count() with imperative loop
- ReflectionValueExtractor: make accessor prefix list a static
  constant instead of per-call Arrays.asList()
- transformer.vm: add null-check in transform(String)

Closes #12553
@dependabot
Bump ch.qos.logback:logback-classic from 1.5.38 to 1.6.0
8d0f7bc 
Upgrade logback-classic dependency to version 1.6.0, which removes
deprecated APIs and bumps SLF4J to 2.0.18.

Closes #12525
@gnodet
Fix #12530: add mvnup upgrade strategies for Maven 4 known compatibil…
82f438a 
…ity issues

Add 4 new mvnup strategies addressing Maven 4 compatibility issues from
the maven4-testing project: update compiler-plugin min to 3.11.0 for
ErrorProne, detect and upgrade old 4.x alpha/beta/RC plugin versions,
migrate deprecated org.scala-tools:maven-scala-plugin to
net.alchim31.maven:scala-maven-plugin, and add DuplicateElementStrategy
to remove duplicate POM elements rejected by Maven 4's stricter parser.
Refactors PluginUpgradeStrategy to derive its map from the PLUGIN_UPGRADES
list instead of maintaining a separate hand-coded map.

Closes #12532
@gnodet
Fix #12531: filter NO_REPOSITORY sentinel from mapped exceptions in A…
6676d1b 
…rtifactResolverResult

Plugins that resolve dependencies (cyclonedx-maven-plugin,
camel-spring-boot-generator) threw IllegalArgumentException because
ArtifactResult.NO_REPOSITORY sentinel leaked as a null key in the
exceptions map exposed through ResultItem.getExceptions(). Filter out
NO_REPOSITORY entries from the mapped exceptions while preserving all
exceptions in a flat allExceptions list so isMissing() still considers
them. Also fixes vacuous-truth bug where an empty exception list was
treated as "all exceptions are ArtifactNotFoundException".

Closes #12533
@arend-von-reinersdorff
Fix Javadoc about default value of consumer POM flattening
88a793a 
Corrects the documentation for MAVEN_CONSUMER_POM_FLATTEN: the default
is false (preserve dependency management), not true (flatten).

Closes #12471
@Hiteshsai007
[MNG-8425] Fix mvnenc init saving invalid master source configuration
fb0e7bb 
When the encryption wizard prompts for an editable value with a
template like env:$MVN_PASSWORD, the user input is now auto-prefixed
with the source prefix (env:, system-property:, etc.) if missing.
Adds parameterized test covering 5 prefix scenarios.

Fixes #10202
Closes #12418
@dependabot
Bump apache/maven-gh-actions-shared release-drafter workflow from 4 to 5
0ead4b4 
Updates the shared release-drafter workflow reference from v4 to v5.
Underlying change: release-drafter 6.4.0 → 7.6.0, removes unsupported
initial-commits-since option.

Closes #12488
@jmestwa-coder
Fix #12427: Reject path-traversal segments in coordinate ids and vers…
7a0e221 
…ions

Coordinate ids (groupId, artifactId) and versions equal to '.' or '..'
pass character validation but become path-traversal segments in the
local repository layout. Both the maven-impl and compat
maven-model-builder validators now reject these values in id checks,
wildcard-id checks, and version checks. Tests added for both modules.

Closes #12410
@gnodet
Fix #12534: Wire up @after annotation processing in Maven core
0003334 
Makes @after repeatable (@afters container), defaults type() to PROJECT,
and wires up annotation processing in BuildPlanExecutor so that mojos
annotated with @after correctly declare ordering constraints. Includes
unit test and integration test (mng-12534-after-annotation).

Closes #12535
@Hiteshsai007 @gnodet @claude
Convert paths for MSYS2 and jvm.config placeholders in bin/mvn (#12546)
6338672 
* Convert paths for MSYS2 and jvm.config placeholders in bin/mvn

The launcher already converted POSIX paths to their native Windows form
for Cygwin and MinGW (GH-7958), but a few paths still reached the JVM in
a mangled or mixed form:

* uname(1) reports MSYS_NT-* for the MSYS2 shell, which did not match the
  MINGW* pattern, so no conversion happened at all there. The MSYS2
  argument conversion then rewrote the POSIX path into the mixed form
  D:/a/... instead of D:\a\...

* ${MAVEN_PROJECTBASEDIR} placeholders in .mvn/jvm.config were expanded
  with the POSIX path, since JvmConfigParser was invoked before the
  conversion took place. The base directory is now converted upfront and
  both representations are kept: the POSIX one to locate jvm.config from
  the shell, the native one for everything handed over to the JVM.

* -Dlibrary.jline.path was built by appending /lib/jline-native to the
  already converted MAVEN_HOME, producing C:\maven/lib/jline-native. It
  is now converted on its own.

Values holding a path are printed with printf rather than echo, including
the debug logging: several POSIX shells (dash and the other Almquist
derivatives commonly installed as /bin/sh) expand backslash escapes in
echo, so C:\tmp\build was emitted with a tab in place of \t. The
conversion is also guarded, so a missing cygpath(1) warns and falls back
to POSIX paths rather than passing empty paths to the JVM.

A shell test covering all of the above is added and wired into the build
through exec-maven-plugin, so mvn verify runs it. It stubs uname, cygpath
and java and runs the launcher with a PATH holding nothing but those
stubs, so the Windows-only code paths are exercised identically on every
platform; keeping the ambient PATH would let the genuine cygpath(1) of an
actual Cygwin/MSYS2 installation be picked up and the missing-cygpath
fallback would never be exercised there.

Related to GH-12537

* Fix #12537: normalize temp dir path in test-mvn-path-conversion.sh

On macOS the $TMPDIR variable ends with a trailing slash, so
mktemp -d "${TMPDIR}/mvn-path-conversion.XXXXXX" produces a path
containing a double slash (e.g. .../T//mvn-path-conversion.XNBzZw).
The pwd(1) calls inside the mvn launcher collapse the double slash,
causing all 22 path assertions to fail on macOS CI runners.

Resolve the work directory through cd/pwd right after creation so
the test's reference paths stay in sync with the launcher output.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Guillaume Nodet <gnodet@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@Hiteshsai007 Hiteshsai007
[MNG-11147] Fix BOM version inference for sibling modules in dependen…
f8c1b16 
…cyManagement

Version and groupId inference in transformFileToRaw was only applied to
direct dependencies but not to dependencies declared in
<dependencyManagement>. This caused installed consumer BOMs to be
missing version tags for reactor sibling modules, making the BOM
unusable by downstream consumers.

Extract the inference loop into a reusable inferDependencies helper and
apply it to both <dependencies> and <dependencyManagement>.

Closes #11147

Co-authored-by: Hiteshsai007 <hiteshsainiki007@gmail.com>
@Hiteshsai007
[MNG-8768] Add executable() function for conditional profile activati…
58844d8 
…on based on PATH

* [MNG-8768] Add executable() function for conditional profile activation based on PATH

Implements MNG-8768 (GitHub #10115): adds an executable(name_or_path)
function to Maven's condition-based profile activation DSL.

The function evaluates to true if the given executable name can be found
in the system PATH, or if an absolute/relative path points directly to an
executable file.

Use-case (from the issue): auto-detect the presence of x86_64-linux-musl-gcc
when building GraalVM native images with the native-maven-plugin, and
conditionally add --static --libc=musl to the build options only when the
compiler wrapper is available on the current machine.

Example pom.xml usage:
  <activation>
    <condition>executable('x86_64-linux-musl-gcc')</condition>
  </activation>

Implementation details:
- ConditionFunctions.executable() delegates to new ExecutableFinder helper
- ExecutableFinder splits the env.PATH system property and probes each
  directory; on Windows it also tries .exe / .cmd / .bat / .com extensions
- Absolute/relative paths (containing a path separator) are checked directly
  without PATH traversal
- PATH is sourced from ProfileActivationContext.getSystemProperty('env.PATH')
  (Maven's normalised env var key), with a System.getenv('PATH') fallback

Tests:
- 5 new end-to-end tests in ConditionProfileActivatorTest (MNG-8768)
- 12 new unit tests in ExecutableFinderTest covering PATH search, Windows
  extension probing, absolute paths, non-executable files, and empty PATH

* Address review comments for executable() function

- Add a warning in DefaultModelValidator if executable() condition is used, noting reproducibility issues
- Add a Javadoc warning to ConditionFunctions.executable()
- Remove System.getenv('PATH') fallback in ExecutableFinder
- Fix OS checking to use ProfileActivationContext instead of System.getProperty
- Convert Paths.get to Path.of
- Remove dead code (candidateNames)
- Update tests: remove fallback test, use @DisabledOnOs(OS.WINDOWS) for OS-specific test

* Address second review: remove accidental file, fix Windows coverage, fix direct-path comment

- Remove accidental your-database.db from repo root
- Remove .replace('\\', '/') from ConditionProfileActivatorTest.testExecutableWithAbsolutePath()
- Fix isExecutableFile() comment: no longer claims caller always filters by extension
- Direct paths on Windows now also probe .exe/.cmd/.bat/.com extensions
- Add contextWithPathAndOs() test helper that sets os.name in context
- Add 3 new Windows-simulated tests:
  - findsExecutableWithWindowsExtensionInPath: PATH search finds my-tool.exe for 'my-tool'
  - findsExecutableWithWindowsExtensionByDirectPath: direct path probes .exe
  - doesNotAppendExtensionOnNonWindows: confirms no extension probing on Linux

* Address minor nit: deduplicate contextWithPath test helpers
@hboutemy
improve doc about deprecating plugin descriptor's requirement
506457a 
(cherry picked from commit 9cf85cf)

# Conflicts:
#	api/maven-api-plugin/src/main/mdo/plugin.mdo
@gnodet @claude
Bump Sisu to 1.1.0 and fix extension realm visibility for JSR330 filt…
6e8fa18 
…ering (#12554)

* Bump Sisu to 1.1.0 and fix extension realm visibility for JSR330 filtering

Sisu 1.1.0 adds JSR330 bean visibility filtering based on ClassRealm
hierarchy (jsr330ComponentVisibilityFollowsPlexusVisibility, on by default).
When TCCL is an extension realm during lifecycle callbacks, Sisu's
FilteredBeans calls RealmManager.computeVisibleNames() which traverses
parent and import realms via BFS. Extension realms have plexus.core as
parent but beans discovered in the container are sourced from the
maven.ext realm. Since extension realms had no import relationship
to maven.ext, container-sourced beans were incorrectly filtered out.

This caused failures with extensions like Mimir that register lifecycle
listeners: when the listener's callback triggered a Sisu dynamic map
access (e.g., NameMapper resolution), the beans were invisible from
the extension's realm, resulting in "Unknown NameMapper name" errors.

The fix adds a reverse import from each extension realm to the container
realm (maven.ext), following the same pattern already used for the
forward direction (maven.ext imports from extension realms). This
makes maven.ext reachable in Sisu's visibility BFS traversal, so
container-sourced beans remain visible regardless of TCCL context.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add IT for GH-12522: non-extension plugin JSR330 component leak

Regression test verifying that plugins NOT marked with
<extensions>true</extensions> do not cause build failures when they
ship JSR330 components whose internal dependencies cannot be resolved
in Maven's container. Uses tycho-bnd-plugin as the reproducer.

With Sisu 1.1.0's jsr330ComponentVisibilityFollowsPlexusVisibility,
non-extension plugin components are filtered out of container-realm
JSR330 lookups, preventing the provisioning error.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Skip GH-12522 IT on JDK < 21 (tycho-bnd-plugin 5.0.3 requires Java 21)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@elharo
Fix #12583: Inverted file existence check in DefaultTransport.put()
286b463 
The condition Files.isRegularFile(source) in DefaultTransport.put() was
inverted — it threw when the file existed and silently accepted non-existent
files, breaking putBytes() and putString() transitively. Added the missing
negation and a new DefaultTransportTest covering non-existent file rejection,
valid file acceptance, and the putBytes() delegation chain.

Closes #12612
@gnodet @claude
Remove erroneous path normalization optimization and add regression test
552a2d5 
Cherry-pick the fix from PR #12617 (by Martin Desruisseaux) which removes
an optimization that skipped path relativization when all patterns started
with "**". This optimization produced false positives when the base
directory path itself contained a segment matching the pattern (e.g., base
directory "something/target/test-classes" with pattern "**/test-classes/**"
would match every file under the base directory).

Add a regression test that constructs the exact false-positive scenario
described in the PR to prevent reintroduction of the optimization.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@gnodet

gnodet commented Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

Closing — will recreate with the correct base (on top of PR #12617).

@gnodet gnodet closed this Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.