slachiewicz opened a new pull request, #2118: URL: https://github.com/apache/maven-resolver/pull/2118
Brings the 1.9.x line level with `master` on five hardening changes it never received. Each one is already public on `master`, so nothing here discloses a weakness that is not already fixed there. | Commit | What `master` has that 1.9.x does not | | --- | --- | | `[f024, f028]` | `LogSanitizer`, absent on 1.9.x, and bounded checksum file reads in `ChecksumUtils` | | `[f008, f027]` | `OriginScopedHeadersInterceptor` and `ResolverRedirectStrategy`, neither present on 1.9.x | | `[f011, f015]` | The checksum-policy strength comparator and mirror policy clamping in `DefaultRemoteRepositoryManager` | | `[f012]` | `DataPool.toKey` keying on `(artifact, repositories)`; 1.9.x still keys on the artifact alone, so a descriptor cached from one repository is reused for another | | `[f018]` | Expiry of stale not-found markers once an artifact is downloaded | The transport module differs between the lines: `master` renamed it to `maven-resolver-transport-apache`, so the `[f008, f027]` change is applied against 1.9.x's `maven-resolver-transport-http` rather than lifted. Two further hardening changes from the same batch are deliberately **not** here, because `master` does not carry them either and a maintenance line should not lead: bounded RFC 9457 error-body reads, and requiring verification before relabeling a resolved artifact. Those want a `master` PR first. Verified: `mvn clean install` -> BUILD SUCCESS, 1078 tests, 0 failures, 0 errors; `spotless:check` clean across all 18 modules. *This change was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
