wilx commented on issue #1484: URL: https://github.com/apache/maven-dependency-plugin/issues/1484#issuecomment-5154017643
This appears to be fixed in Maven Dependency Plugin **3.10.0**. I verified it with a minimal sources JAR containing an NTFS extra timestamp that follows the reported `FileTimes.ntfsTimeToFileTime` failure path. End-to-end `unpack-dependencies` results: - 3.8.1: fails with `Invalid extra data in entry META-INF/: long overflow` on Maven 3.9.5 and Maven 4.0.0-rc-5. - 3.9.0: the arithmetic overflow is gone, but extraction still fails with `Negative time` on both Maven versions. - 3.10.0: succeeds on Maven 4.0.0-rc-5. - 3.11.0: succeeds on Maven 3.9.5 and Maven 4.0.0-rc-5. Commons IO 2.19.0 fixes IO-873's overflow itself; Maven Dependency Plugin 3.10.0 is the first tested plugin release where this malformed timestamp is unpacked successfully end to end. The original private JAR from this report is unavailable, so this was verified with a synthetic reproducer that exercises the same NTFS timestamp parsing path. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
