gnodet commented on code in PR #13141:
URL: https://github.com/apache/maven/pull/13141#discussion_r4018738959
##########
impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java:
##########
@@ -1722,10 +1722,14 @@ private List<Profile> getActiveProfiles(
// A model resolved to satisfy dependency resolution -- a
dependency POM
// itself, or one of its parents, reached transitively --
evaluates only
// platform-derived activation (JDK version, operating
system,
- // activeByDefault); its profiles contribute no
repositories.
+ // activeByDefault). Repository stripping is intentionally
omitted here:
+ // the sandbox activation context (see #13112) already
suppresses consumer
+ // -D flags and file conditions, so only
legitimately-active profiles reach
+ // injection. Stripping their repositories would break the
established
+ // project → dep1 → dep2 pattern where dep1 declares
dep2's repository
+ // inside an activeByDefault or JDK-activated profile.
eligibleProfiles = interpolatedProfiles.stream()
.filter(profile ->
!hasFileOrPropertyOrConditionActivation(profile))
- .map(profile ->
profile.withRepositories(List.of()).withPluginRepositories(List.of()))
.toList();
}
return profileSelector.getActiveProfiles(eligibleProfiles,
profileActivationContext, this);
Review Comment:
Fixed in a2460d375f: added `// TODO(#428): repositories contributed by
external-model profiles can shadow central; a WARN/FAIL policy for URL
mismatches should be added separately.` immediately before `return
profileSelector.getActiveProfiles(...)`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
