elharo opened a new issue, #137:
URL: https://github.com/apache/maven-dependency-tree/issues/137
## Summary
`getVersionSelectedFromRange(...)` dereferences
`constraint.getRange().toString()` whenever the constraint has no direct
version, without guarding against a null range. A `VersionConstraint` where
both `getVersion()` and `getRange()` are null would throw a
`NullPointerException`.
## Affected code
-
`src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:238-244`
-
`src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyGraphBuilder.java:166-172`
## Impact
In practice Aether usually guarantees at least one of version/range is set,
so this is an edge case — but it is unguarded and cheap to make robust.
## Suggested fix
```
if ((constraint == null) || (constraint.getVersion() != null) ||
(constraint.getRange() == null)) {
return null;
}
return constraint.getRange().toString();
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
