gnodet opened a new pull request, #13450: URL: https://github.com/apache/maven/pull/13450
## Summary - A dependency POM's own `<properties>` must not activate its property-based profiles - The `externalActivationContext()` sandbox was merging model properties into the system-property lookup, causing POMs like jruby-base to self-activate profiles unintentionally (#13390) - Remove the merge — only system properties and negated-property checks drive profile activation in external builds, restoring 3.9.x semantics - This does **not** affect #13084 (RESTEasy), which uses a negated-property profile (`!resteasy.dependencies.eap`) that works correctly without the merge ### Background The #13084 fix introduced a sandboxed `ProfileActivationContext` for external model builds. The sandbox correctly suppresses user `-D` flags and file activation, but it also merged POM `<properties>` into the system-property lookup as a new behavior that never existed in 3.9.x. This caused #13390: POMs that declare a property with the same name as a profile activation key (like jruby-base's `tzdata.version`) would self-activate that profile. Analysis of the actual RESTEasy POM that motivated #13084 shows it uses a **negated-property** profile (`!resteasy.dependencies.eap`), not a positive POM-property activation. Negated-property profiles work correctly without the merge — the property is absent from the sandbox, so `!flag` evaluates to true. ### Changes **Both stacks** (compat `maven-model-builder` and new `impl/maven-impl`): - `DefaultModelBuilder` / `DefaultProfileActivationContext`: remove POM-property merge from external-model sandbox - `PropertyProfileActivator`: update comments to reflect new semantics - `ProfileActivationContext` interfaces: update Javadoc on model/project properties **Tests**: added jruby-style (#13390 regression) and resteasy-style (#13084 non-regression) test cases ## Test plan - [x] Compat `ExternalModelProfileActivationTest` — 12 tests pass - [ ] Impl `DefaultModelBuilderTest` — has pre-existing `ApiRunner` compile failure on master (unrelated) - [ ] Integration test with jruby-base-9.4.2.0 dependency (manual verification) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
