Skip to content

Conversation

@cstamas
Copy link
Member

@cstamas cstamas commented Oct 9, 2025

Maven 4 wrongly issued resolver requests with mismanaged list of remote repositories (duplicates), and while this was not "deadly", this causes several issues like cache misses and cache inflation (as requests for same artifact but duplicate repositories causes cache miss).

@cstamas cstamas changed the title Session: add method to prepare for resolving Repository management fixes Oct 9, 2025
@cstamas cstamas requested a review from gnodet October 9, 2025 14:10
@cstamas cstamas self-assigned this Oct 9, 2025
@cstamas cstamas added the bug Something isn't working label Oct 9, 2025
@cstamas cstamas added this to the 4.1.0 milestone Oct 9, 2025
@cstamas cstamas marked this pull request as ready for review October 9, 2025 14:38
…javadoc

- Renamed RemoteRepositoryRequest to RepositoryAwareRequest for better clarity
  - The name now reflects that these are requests that are 'aware of' repositories
  - Avoids confusion with requests 'for' repositories themselves
- Enhanced javadoc with comprehensive documentation:
  - Clear description of the interface purpose and usage
  - Detailed explanation of repository validation logic
  - Better parameter and return value documentation
  - Improved exception messages with specific details about validation failures
- Updated all implementing interfaces to use the new name
@gnodet gnodet force-pushed the session-resolve-repo branch from 4d9a174 to 7abeac8 Compare October 9, 2025 20:42
@gnodet gnodet merged commit f634360 into apache:master Oct 10, 2025
19 checks passed
gnodet pushed a commit to gnodet/maven that referenced this pull request Oct 10, 2025
…handling (apache#11238)

This change introduces a new RepositoryAwareRequest interface that consolidates
repository handling across multiple Maven service request types, addressing
issues with duplicate repositories being passed to resolvers.

Key changes:

* Add RepositoryAwareRequest interface with repository validation:
  - Provides getRepositories() method and validate() logic
  - Prevents duplicate repositories and null entries
  - Consolidates common repository functionality

* Refactor service request interfaces to extend RepositoryAwareRequest:
  - ArtifactResolverRequest, DependencyResolverRequest, ModelBuilderRequest
  - ProjectBuilderRequest, VersionRangeResolverRequest, VersionResolverRequest
  - Apply repository validation in all implementations

* Fix repository leakage in DefaultProjectBuilder:
  - Store project-specific repositories in BuildSession
  - Implement proper repository merging based on strategy
  - Prevent cross-contamination between sibling projects

* Update resolvers to use toResolvingRepositories() for consistent handling

* Add RepositoryLeakageTest to verify proper isolation between projects

This eliminates duplicate repositories being sent to resolvers and ensures
consistent repository handling across all Maven service requests.

(cherry picked from commit f634360)
@gnodet
Copy link
Contributor

gnodet commented Oct 10, 2025

💚 All backports created successfully

Status Branch Result
maven-4.0.x

Questions ?

Please refer to the Backport tool documentation

@cstamas cstamas deleted the session-resolve-repo branch October 10, 2025 07:39
gnodet added a commit that referenced this pull request Oct 10, 2025
…handling (#11238) (#11244)

This change introduces a new RepositoryAwareRequest interface that consolidates
repository handling across multiple Maven service request types, addressing
issues with duplicate repositories being passed to resolvers.

Key changes:

* Add RepositoryAwareRequest interface with repository validation:
  - Provides getRepositories() method and validate() logic
  - Prevents duplicate repositories and null entries
  - Consolidates common repository functionality

* Refactor service request interfaces to extend RepositoryAwareRequest:
  - ArtifactResolverRequest, DependencyResolverRequest, ModelBuilderRequest
  - ProjectBuilderRequest, VersionRangeResolverRequest, VersionResolverRequest
  - Apply repository validation in all implementations

* Fix repository leakage in DefaultProjectBuilder:
  - Store project-specific repositories in BuildSession
  - Implement proper repository merging based on strategy
  - Prevent cross-contamination between sibling projects

* Update resolvers to use toResolvingRepositories() for consistent handling

* Add RepositoryLeakageTest to verify proper isolation between projects

This eliminates duplicate repositories being sent to resolvers and ensures
consistent repository handling across all Maven service requests.

(cherry picked from commit f634360)

Co-authored-by: Tamas Cservenak <tamas@cservenak.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-to-4.0.x bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants