gnodet opened a new pull request, #13095: URL: https://github.com/apache/maven/pull/13095
## Summary Profiles activated by a **negated property condition** (`<name>!foo</name>`, no value) fire when the property is *absent* — the classic "opt-out flag" idiom. Such profiles are on by default and can only be suppressed (by setting the property), never injected by supplying one. The previous implementation treated **all** property conditions as unsafe and filtered them out of external model builds (`withoutFileAndPropertyActivation` / `hasFileOrPropertyOrConditionActivation`). This broke effective model construction for any POM that relies on negated-property profiles to inject dependency versions — `resteasy-client:7.0.0.Final` is a canonical example (its `resteasy-default` profile activates on `!resteasy.dependencies.eap`). When those versions were missing, the effective-model validator reported them as errors and threw `ModelBuildingException`. ## Root cause The filter introduced in commit `03c947d8` to prevent environment-controlled profiles from injecting repositories into external models blocked negated-property activations as a side effect. Negated conditions are the opposite of the threat model: an attacker cannot *force* them on — they are already on by default. ## Fix Both the compat (`DefaultModelBuilder`) and the Maven 4 impl (`DefaultModelBuilder` / `hasFileOrPropertyOrConditionActivation`) now treat a **negated-name-only** property condition as environment-independent and allow it through the filter. All other property conditions (positive name, or a required value) remain blocked. The existing repository-stripping step is unaffected — external models still cannot inject repositories. ## Test Added `negatedPropertyActivatedProfileIsPreservedInExternalModelBuild()` to `DefaultModelBuilderTest`: builds a POM in `VALIDATION_LEVEL_MINIMAL` mode (the same level used by the artifact descriptor reader) with a profile activated by `!skip.defaults`; verifies that the profile activates and its dependency appears in the effective model. Fixes #13084 --- _Hermes Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
