gnodet commented on issue #13146:
URL: https://github.com/apache/maven/issues/13146#issuecomment-6287164769
After analysis, the current `REQUEST_DOMINANT` merge mode (used by
`DefaultArtifactDescriptorReader` for all dependency resolution) already fully
mitigates this concern:
1. **Same-id shadowing is blocked**: when a dependency POM declares a
repository with an id that already exists in the request (e.g. `central` from
the super POM), the dependency's declaration is silently dropped. The existing
URL is preserved.
2. **The scope is limited**: each dependency is resolved in its own derived
`ModelBuilderSessionState`. Repository changes during dependency resolution
don't propagate back to the parent state — they are subtree-scoped.
3. **A warning would not be actionable**:
- If the user has already redeclared the repository in their POM (the
natural "fix"), it's already overridden — no warning needed.
- If the user has *not* redeclared it, the dependency's repository (with
a new id) is legitimately needed for resolving that dependency's transitive
dependencies — no warning needed either.
- For `central` specifically, it's always present from the super POM, so
the shadow is always blocked without any user action.
The `POM_DOMINANT` case (raised in the earlier comment) only applies to the
project's own parent chain during project building, where overriding `central`
is expected behavior (since `central` comes from the super POM's defaults).
Closing as already mitigated.
_Claude Code on behalf of Guillaume Nodet_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
