elharo opened a new issue, #268:
URL: https://github.com/apache/maven-remote-resources-plugin/issues/268
## Summary
`getProjects()` mutates the version of each artifact while
filtering/iterating dependencies, and for the non-aggregate `process` mojo
these are the live instances from `project.getArtifacts()`.
`src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java:509-575`
```java
for (Artifact artifact : artifacts) {
if (artifact.isSnapshot()) {
artifact.setVersion(artifact.getBaseVersion()); // mutates shared
object
}
...
}
```
`artifacts` is a `new LinkedHashSet<>(getAllDependencies())` — a copy of the
*set*, but the `Artifact` objects inside are the same references.
`ProcessRemoteResourcesMojo.getAllDependencies()` returns
`project.getArtifacts()` directly (`ProcessRemoteResourcesMojo.java:65-67`), so
`setVersion(...)` rewrites the version of the project's resolved artifacts
(e.g. stripping the timestamp from a timestamped snapshot to its base version).
## Impact
A side effect on the in-memory project model: later build steps that read
`project.getArtifacts()` (or `session.getProjects()` in the aggregate case) see
the modified versions. This is triggered only when a template references
`$projects`/`$projectsSortedByOrganization`, making it a non-obvious,
order-dependent mutation.
## Suggested fix
Avoid mutating the shared instances — build a new `DefaultArtifact` (or
copy) with the base version, or use the base version only for model building
without calling `setVersion` on the original.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
