elharo opened a new issue, #12594: URL: https://github.com/apache/maven/issues/12594
# DefaultMaven: LegacySupport.setSession() thread safety in @Singleton **Found in:** maven-4.0.x branch **File:** `impl/maven-core/src/main/java/org/apache/maven/DefaultMaven.java` (lines 225, 161) **Severity:** High ## Description `DefaultMaven` is annotated `@Singleton`, meaning a single instance is shared across the application. `LegacySupport` is a thread-local-like holder for the current `MavenSession`. The `setSession()` calls at lines 225 and 161 are not synchronized: ```java // line 225: legacySupport.setSession(session); // line 161 (in finally): legacySupport.setSession(null); ``` If `execute()` were called concurrently from multiple threads, calls to `setSession()` and `setSession(null)` from different threads would race, causing sessions to leak or be corrupted. While Maven is traditionally single-threaded per JVM, the `@Singleton` annotation combined with mutable instance state is a latent concurrency bug. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
