gnodet-bot commented on code in PR #29778:
URL: https://github.com/apache/camel/pull/29778#discussion_r4556960235
##########
tooling/camel-tooling-maven/src/main/java/org/apache/camel/tooling/maven/MavenDownloaderImpl.java:
##########
@@ -601,10 +617,74 @@ public List<MavenArtifact> resolveArtifacts(
session.getDependencySelector(), new
AvailableDependencySelector(available)));
session = availableSession;
}
+ if (managed != null && !managed.isEmpty() && transitively) {
+ // the versions of the managed artifacts, whatever their classifier
+ Map<String, String> versions = new HashMap<>();
+ for (MavenGav gav : managed) {
+ versions.putIfAbsent(gav.getGroupId() + ":" +
gav.getArtifactId(), gav.getVersion());
+ }
+ DefaultRepositorySystemSession managedSession = new
DefaultRepositorySystemSession(session);
+ managedSession.setDependencyManager(
+ new
ManagedVersionDependencyManager(session.getDependencyManager(), versions, 0));
+ session = managedSession;
+ }
return doResolveArtifacts(rootGav, dependencyGAVs, extraRepositories,
transitively, useApacheSnapshots, session);
}
+ /**
+ * Gives the transitive dependencies on the managed artifacts their
version, whatever their classifier (such as a
+ * native JAR of another platform), as the dependencyManagement of a Maven
project would. The dependencies asked for
+ * directly keep their version.
+ */
+ static final class ManagedVersionDependencyManager implements
DependencyManager {
+
+ private final DependencyManager delegate;
+ private final Map<String, String> versions;
+ private final int depth;
+
+ ManagedVersionDependencyManager(DependencyManager delegate,
Map<String, String> versions, int depth) {
+ this.delegate = delegate;
+ this.versions = versions;
+ this.depth = depth;
+ }
+
+ @Override
+ public DependencyManagement manageDependency(Dependency dependency) {
+ DependencyManagement management = delegate != null ?
delegate.manageDependency(dependency) : null;
+ // depth 1 are the dependencies asked for
+ if (depth >= 2) {
+ Artifact a = dependency.getArtifact();
+ String version = versions.get(a.getGroupId() + ":" +
a.getArtifactId());
+ if (version != null && !version.equals(a.getVersion())) {
+ if (management == null) {
+ management = new DependencyManagement();
+ }
+ management.setVersion(version);
+ }
Review Comment:
💡 `management` here may be the object returned by
`delegate.manageDependency(dependency)`. When non-null, the code mutates it
in-place via `setVersion()` without creating a defensive copy. If the delegate
caches or reuses the returned `DependencyManagement` instance, this could
corrupt its state across calls.
Consider creating a defensive copy before mutating:
```java
if (management == null) {
management = new DependencyManagement();
} else {
DependencyManagement copy = new DependencyManagement();
copy.setVersion(management.getVersion());
management = copy;
}
management.setVersion(version);
```
_This review was generated by an AI agent, Hermès on behalf of @gnodet._
<!-- reviewer: gnodet-bot -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
