slachiewicz opened a new pull request, #2113: URL: https://github.com/apache/maven-resolver/pull/2113
Since #2082, when the auto-discovered prefixes file denies a path and the one-per-repository existence check shows the repository does serve it, only that exact path is allowed and the prefixes file stays enforcing for everything else. Resolution asks for an artifact's POM during collection and for its JAR (and classified artifacts, checksums, signatures) later, and the existence check runs only once per repository and session. With a stale prefixes file the POM was therefore probed, served and allowed, and the JAR of the same artifact was then denied with no probe. That is the failure mode the verification introduced in 2.0.21 was meant to remove, in a more confusing shape. The verified path's directory is now allowed instead of the single file: the whole artifact, and for a served `maven-metadata.xml` the versions below it. All other paths stay denied, and `verifyDeniedDropsTree` keeps its meaning. The site page said "since 2.0.22" for this behaviour; it ships in 2.0.23, corrected. Two tests cover the POM-then-JAR case and the metadata case. *This change was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
