This is an automated email from the ASF dual-hosted git repository. gnodet pushed a commit to branch fix-gh12305 in repository https://gitbox.apache.org/repos/asf/maven.git
commit 5ed6beb0e259429dde9b8d259cbfad3cc80e6c72 Author: Guillaume Nodet <[email protected]> AuthorDate: Thu Jun 18 11:35:40 2026 +0000 [#12305] Filter uninterpolated deps in ArtifactDescriptorReaderDelegate and DefaultProjectDependenciesResolver Complete the backport of #12084 on maven-4.0.x. The delegate and the legacy project dependencies resolver were adding dependencies with uninterpolated property expressions (e.g. ${osgi.version}) without filtering, causing "Invalid Collect Request: null" errors when MavenValidator rejects them during dependency collection. Add inline filtering before addDependency/addManagedDependency calls, matching the pattern used on master. Co-authored-by: Claude Opus 4.6 <[email protected]> --- .../DefaultProjectDependenciesResolver.java | 9 ++++ .../resolver/ArtifactDescriptorReaderDelegate.java | 19 ++++++++ ...ollectRequestUninterpolatedManagedDepsTest.java | 57 ++++++++++++++++++++++ .../gh-12305-invalid-collect-request/pom.xml | 22 +++++++++ .../apache/maven/its/gh12305/bom/0.1/bom-0.1.pom | 27 ++++++++++ .../settings-template.xml | 43 ++++++++++++++++ 6 files changed, 177 insertions(+) diff --git a/impl/maven-core/src/main/java/org/apache/maven/project/DefaultProjectDependenciesResolver.java b/impl/maven-core/src/main/java/org/apache/maven/project/DefaultProjectDependenciesResolver.java index 20123cc954..5114f2becd 100644 --- a/impl/maven-core/src/main/java/org/apache/maven/project/DefaultProjectDependenciesResolver.java +++ b/impl/maven-core/src/main/java/org/apache/maven/project/DefaultProjectDependenciesResolver.java @@ -145,6 +145,11 @@ public DependencyResolutionResult resolve(DependencyResolutionRequest request) DependencyManagement depMgmt = project.getDependencyManagement(); if (depMgmt != null) { for (Dependency dependency : depMgmt.getDependencies()) { + if (containsPlaceholder(dependency.getGroupId()) + || containsPlaceholder(dependency.getArtifactId()) + || containsPlaceholder(dependency.getVersion())) { + continue; + } collect.addManagedDependency(RepositoryUtils.toDependency(dependency, stereotypes)); } } @@ -195,6 +200,10 @@ public DependencyResolutionResult resolve(DependencyResolutionRequest request) return result; } + private static boolean containsPlaceholder(String value) { + return value != null && value.contains("${"); + } + private void process(DefaultDependencyResolutionResult result, Collection<ArtifactResult> results) { for (ArtifactResult ar : results) { DependencyNode node = ar.getRequest().getDependencyNode(); diff --git a/impl/maven-impl/src/main/java/org/apache/maven/impl/resolver/ArtifactDescriptorReaderDelegate.java b/impl/maven-impl/src/main/java/org/apache/maven/impl/resolver/ArtifactDescriptorReaderDelegate.java index fc105b0dfd..3c35732e6b 100644 --- a/impl/maven-impl/src/main/java/org/apache/maven/impl/resolver/ArtifactDescriptorReaderDelegate.java +++ b/impl/maven-impl/src/main/java/org/apache/maven/impl/resolver/ArtifactDescriptorReaderDelegate.java @@ -56,17 +56,26 @@ public void populateResult(InternalSession session, ArtifactDescriptorResult res ArtifactTypeRegistry stereotypes = session.getSession().getArtifactTypeRegistry(); for (Repository r : model.getRepositories()) { + if (containsPlaceholder(r.getId()) || containsPlaceholder(r.getUrl())) { + continue; + } result.addRepository(session.toRepository( session.getService(RepositoryFactory.class).createRemote(r))); } for (org.apache.maven.api.model.Dependency dependency : model.getDependencies()) { + if (hasUninterpolatedExpression(dependency)) { + continue; + } result.addDependency(convert(dependency, stereotypes)); } DependencyManagement mgmt = model.getDependencyManagement(); if (mgmt != null) { for (org.apache.maven.api.model.Dependency dependency : mgmt.getDependencies()) { + if (hasUninterpolatedExpression(dependency)) { + continue; + } result.addManagedDependency(convert(dependency, stereotypes)); } } @@ -133,6 +142,16 @@ private Exclusion convert(org.apache.maven.api.model.Exclusion exclusion) { return new Exclusion(exclusion.getGroupId(), exclusion.getArtifactId(), "*", "*"); } + private static boolean hasUninterpolatedExpression(org.apache.maven.api.model.Dependency dependency) { + return containsPlaceholder(dependency.getGroupId()) + || containsPlaceholder(dependency.getArtifactId()) + || containsPlaceholder(dependency.getVersion()); + } + + private static boolean containsPlaceholder(String value) { + return value != null && value.contains("${"); + } + private void setArtifactProperties(ArtifactDescriptorResult result, Model model) { String downloadUrl = null; DistributionManagement distMgmt = model.getDistributionManagement(); diff --git a/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12305InvalidCollectRequestUninterpolatedManagedDepsTest.java b/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12305InvalidCollectRequestUninterpolatedManagedDepsTest.java new file mode 100644 index 0000000000..25c9552bb2 --- /dev/null +++ b/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12305InvalidCollectRequestUninterpolatedManagedDepsTest.java @@ -0,0 +1,57 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.maven.it; + +import java.io.File; + +import org.junit.jupiter.api.Test; + +/** + * Verify that importing a BOM whose dependencyManagement contains a managed dependency + * with an unresolved {@code ${…}} property placeholder does not cause a build failure + * when that managed dependency is never actually used. + * <p> + * This reproduces the "Invalid Collect Request: null" error seen with projects like + * Apache Causeway, where the parent BOM declares {@code org.osgi:osgi.core:${osgi.version}} + * without defining {@code osgi.version}. Maven 4's {@code MavenValidator} rejects + * the uninterpolated version during {@code collectDependencies()}, even though the + * dependency is never resolved. + * + * @see <a href="https://github.com/apache/maven/issues/12305";>gh-12305</a> + */ +public class MavenITgh12305InvalidCollectRequestUninterpolatedManagedDepsTest extends AbstractMavenIntegrationTestCase { + + MavenITgh12305InvalidCollectRequestUninterpolatedManagedDepsTest() { + super("[4.0.0-rc-3,)"); + } + + @Test + public void testUninterpolatedManagedDepsFromImportedBom() throws Exception { + File testDir = extractResources("/gh-12305-invalid-collect-request"); + + Verifier verifier = newVerifier(testDir.getAbsolutePath()); + verifier.deleteArtifacts("org.apache.maven.its.gh12305"); + verifier.filterFile("settings-template.xml", "settings.xml"); + verifier.addCliArgument("--settings"); + verifier.addCliArgument("settings.xml"); + verifier.addCliArgument("compile"); + verifier.execute(); + verifier.verifyErrorFreeLog(); + } +} diff --git a/its/core-it-suite/src/test/resources/gh-12305-invalid-collect-request/pom.xml b/its/core-it-suite/src/test/resources/gh-12305-invalid-collect-request/pom.xml new file mode 100644 index 0000000000..abac948631 --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12305-invalid-collect-request/pom.xml @@ -0,0 +1,22 @@ +<?xml version="1.0" encoding="UTF-8"?> +<project xmlns="http://maven.apache.org/POM/4.0.0"; + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd";> + <modelVersion>4.0.0</modelVersion> + <groupId>org.apache.maven.its.gh12305</groupId> + <artifactId>test</artifactId> + <version>0.1</version> + <packaging>jar</packaging> + + <dependencyManagement> + <dependencies> + <dependency> + <groupId>org.apache.maven.its.gh12305</groupId> + <artifactId>bom</artifactId> + <version>0.1</version> + <type>pom</type> + <scope>import</scope> + </dependency> + </dependencies> + </dependencyManagement> +</project> diff --git a/its/core-it-suite/src/test/resources/gh-12305-invalid-collect-request/repo/org/apache/maven/its/gh12305/bom/0.1/bom-0.1.pom b/its/core-it-suite/src/test/resources/gh-12305-invalid-collect-request/repo/org/apache/maven/its/gh12305/bom/0.1/bom-0.1.pom new file mode 100644 index 0000000000..d9e3bfd299 --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12305-invalid-collect-request/repo/org/apache/maven/its/gh12305/bom/0.1/bom-0.1.pom @@ -0,0 +1,27 @@ +<?xml version="1.0" encoding="UTF-8"?> +<project xmlns="http://maven.apache.org/POM/4.0.0"; + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd";> + <modelVersion>4.0.0</modelVersion> + <groupId>org.apache.maven.its.gh12305</groupId> + <artifactId>bom</artifactId> + <version>0.1</version> + <packaging>pom</packaging> + + <dependencyManagement> + <dependencies> + <!-- + This managed dependency uses a property that is NOT defined anywhere + in the BOM or its parent chain. In Maven 3, this was silently ignored + for unused managed deps. In Maven 4, MavenValidator rejects it during + collectDependencies(), even when the dependency is never actually used. + --> + <dependency> + <groupId>org.example</groupId> + <artifactId>lib-with-undefined-version</artifactId> + <version>${undefined.version}</version> + <scope>provided</scope> + </dependency> + </dependencies> + </dependencyManagement> +</project> diff --git a/its/core-it-suite/src/test/resources/gh-12305-invalid-collect-request/settings-template.xml b/its/core-it-suite/src/test/resources/gh-12305-invalid-collect-request/settings-template.xml new file mode 100644 index 0000000000..c985d1a689 --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12305-invalid-collect-request/settings-template.xml @@ -0,0 +1,43 @@ +<?xml version="1.0" encoding="UTF-8"?> + +<!-- +Licensed to the Apache Software Foundation (ASF) under one +or more contributor license agreements. See the NOTICE file +distributed with this work for additional information +regarding copyright ownership. The ASF licenses this file +to you under the Apache License, Version 2.0 (the +"License"); you may not use this file except in compliance +with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, +software distributed under the License is distributed on an +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +KIND, either express or implied. See the License for the +specific language governing permissions and limitations +under the License. +--> + +<settings> + <profiles> + <profile> + <id>maven-core-it-repo</id> + <repositories> + <repository> + <id>maven-core-it</id> + <url>@baseurl@/repo</url> + <releases> + <checksumPolicy>ignore</checksumPolicy> + </releases> + <snapshots> + <enabled>false</enabled> + </snapshots> + </repository> + </repositories> + </profile> + </profiles> + <activeProfiles> + <activeProfile>maven-core-it-repo</activeProfile> + </activeProfiles> +</settings>
