slachiewicz opened a new pull request, #13007: URL: https://github.com/apache/maven/pull/13007
`DefaultModelResolver` in `maven-resolver-provider` builds the models of artifact descriptors resolved from repositories (dependency POMs and their parents and imports). The repositories those models declare are remotely supplied input, but they were aggregated with the same call as build-supplied repositories, so a `<server>` in `settings.xml` whose id matched a repository id in a downloaded POM had its credentials attached to that repository. maven-resolver 1.9.28 (apache/maven-resolver#2092) adds an `aggregateRepositories` overload with a provenance flag: descriptor-declared repositories receive session authentication only when an operator-defined mirror captures them, and `aether.remoteRepositoryManager.authToDescriptorRepositories=true` restores the previous behaviour. This passes that flag from the one call site that builds descriptor models. `ProjectModelResolver` builds the project's own model and parents, which are operator-chosen, and keeps the four-argument call. Blocked on the maven-resolver 1.9.28 release: the second commit bumps `resolverVersion` to `1.9.28-SNAPSHOT` as a build aid and must be dropped, and the first commit does not compile against 1.9.27. Verified: `mvn -pl maven-resolver-provider,maven-core -am verify` against 1.9.28-SNAPSHOT → 363 tests, 0 failures. *This change was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
