gnodet commented on code in PR #13141:
URL: https://github.com/apache/maven/pull/13141#discussion_r4018757269
##########
impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java:
##########
@@ -1722,10 +1722,14 @@ private List<Profile> getActiveProfiles(
// A model resolved to satisfy dependency resolution -- a
dependency POM
// itself, or one of its parents, reached transitively --
evaluates only
// platform-derived activation (JDK version, operating
system,
- // activeByDefault); its profiles contribute no
repositories.
+ // activeByDefault). Repository stripping is intentionally
omitted here:
+ // the sandbox activation context (see #13112) already
suppresses consumer
+ // -D flags and file conditions, so only
legitimately-active profiles reach
+ // injection. Stripping their repositories would break the
established
+ // project → dep1 → dep2 pattern where dep1 declares
dep2's repository
+ // inside an activeByDefault or JDK-activated profile.
eligibleProfiles = interpolatedProfiles.stream()
Review Comment:
Fixed in 5ed266b5b6: added a TODO comment referencing issue #13146 (opened
specifically to track the WARN/FAIL policy for URL mismatches): `//
TODO(#13146): repositories contributed by external-model profiles can shadow
central; a WARN/FAIL policy for URL mismatches should be added separately.`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
