(maven) branch maven-4.0.x updated: Filter transitive repositories with uninterpolated IDs (#12049) (#12050) (#12070)

[gnodet]

This is an automated email from the ASF dual-hosted git repository.

gnodet pushed a commit to branch maven-4.0.x
in repository https://gitbox.apache.org/repos/asf/maven.git


The following commit(s) were added to refs/heads/maven-4.0.x by this push:
     new 6b42a8e69b Filter transitive repositories with uninterpolated IDs 
(#12049) (#12050) (#12070)
6b42a8e69b is described below

commit 6b42a8e69b30cd89a0c004166634c8cf89089d51
Author: Guillaume Nodet <gno...@gmail.com>
AuthorDate: Tue May 19 13:51:17 2026 +0200

    Filter transitive repositories with uninterpolated IDs (#12049) (#12050) 
(#12070)
    
    The existing filter in mergeRepositories already excluded transitive
    repositories with uninterpolated URLs but did not check repository IDs.
    When a transitive dependency POM contained an expression like
    ${eclipseP2RepoId} as a repository ID with a valid URL, it passed the
    filter and later caused MavenValidator to throw IllegalArgumentException.
    
    Co-authored-by: Claude Opus 4.6 (1M context) <nore...@anthropic.com>
---
 .../main/java/org/apache/maven/impl/model/DefaultModelBuilder.java  | 4 +++-
 .../java/org/apache/maven/impl/model/DefaultModelBuilderTest.java   | 6 +++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git 
a/impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java
 
b/impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java
index b3356a2208..7e155fa4dd 100644
--- 
a/impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java
+++ 
b/impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java
@@ -541,7 +541,9 @@ public void mergeRepositories(Model model, boolean replace) 
{
                     // filter out transitive invalid repositories
                     // this should be safe because invalid repo coming from 
build POMs
                     // have been rejected earlier during validation
-                    .filter(repo -> repo.getUrl() != null && 
!repo.getUrl().contains("${"))
+                    .filter(repo -> repo.getUrl() != null
+                            && !repo.getUrl().contains("${")
+                            && (repo.getId() == null || 
!repo.getId().contains("${")))
                     .map(session::createRemoteRepository)
                     .toList();
             if (replace) {
diff --git 
a/impl/maven-impl/src/test/java/org/apache/maven/impl/model/DefaultModelBuilderTest.java
 
b/impl/maven-impl/src/test/java/org/apache/maven/impl/model/DefaultModelBuilderTest.java
index 5f6146fc2c..d361faad12 100644
--- 
a/impl/maven-impl/src/test/java/org/apache/maven/impl/model/DefaultModelBuilderTest.java
+++ 
b/impl/maven-impl/src/test/java/org/apache/maven/impl/model/DefaultModelBuilderTest.java
@@ -107,12 +107,16 @@ public void testMergeRepositories() throws Exception {
                         Repository.newBuilder()
                                 .id("third")
                                 .url("${thirdParentRepo}")
+                                .build(),
+                        Repository.newBuilder()
+                                .id("${uninterpolatedRepoId}")
+                                .url("https://valid.url";)
                                 .build()))
                 .build();
 
         state.mergeRepositories(model, false);
 
-        // after merge
+        // after merge: "second" filtered (uninterpolated URL), 
"${uninterpolatedRepoId}" filtered (uninterpolated ID)
         repositories = (List<RemoteRepository>) repositoriesField.get(state);
         assertEquals(3, repositories.size());
         assertEquals("first", repositories.get(0).getId());