gnodet opened a new pull request, #13164: URL: https://github.com/apache/maven/pull/13164
Forward-port of findings from the review of #13158 (4.0.x backport). ## Changes ### compat — mutable map leak in `externalActivationContext()` The lazy `getSystemProperties()` implementation returned a mutable map in both branches: - empty-projectProps: returned raw `delegate.getSystemProperties()` - non-empty branch: stored and returned an unwrapped `HashMap` A caller who mutates the underlying system-properties map after creating the sandbox would see those changes inside, silently violating the "system wins over model properties" invariant. Fixed by wrapping both branches with `Collections.unmodifiableMap()`. ### impl — `missing()` condition profiles incorrectly activate in `CONSUMER_DEPENDENCY` builds The `nonFileProfiles` pre-filter excluded profiles with `activation.file != null` but not condition profiles whose expression calls `missing(path)`. Inside the sandbox, `context.exists()` always returns `false`, so `missing(path) = !false = true` fires unconditionally — the same footgun as `<file><missing>` that the file pre-filter was introduced to prevent. Fix: add `hasFileConditionExpression()` helper (checks for `exists(`/`missing(` in `<condition>`) and extend the filter to also exclude such profiles. ### Tests Added `missing-condition` profile to `resolved-model-with-profiles.xml`: - fires in `BUILD_PROJECT` (path genuinely absent — normal behaviour) - suppressed in `CONSUMER_DEPENDENCY` (pre-filtered by `hasFileConditionExpression`) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
