gnodet commented on issue #13390: URL: https://github.com/apache/maven/issues/13390#issuecomment-6135086862
_Fully automatic review from Claude Code_ The root cause has been identified and fixes are submitted: - **#13450** — master - **#13451** — maven-3.10.x backport - **#13452** — maven-4.0.x backport ### Analysis The `externalActivationContext()` sandbox introduced by #13084 / #13114 was merging POM `<properties>` into the system-property lookup for external model builds. This caused dependency POMs to self-activate their own property-based profiles — exactly the bug reported here with jruby-base's `tzdata.version`. However, this POM-property merge was **not needed** to fix #13084. The actual RESTEasy profile that motivated #13084 uses a **negated-property** pattern (`!resteasy.dependencies.eap`), which works correctly without the merge: the property is absent from the sandbox, so `!flag` evaluates to true. The merge was a net-new behavior that never existed in 3.9.x. ### Fix Remove the POM-property merge from the sandbox. Profile activation in external builds now only consults system properties (platform facts like `java.version`, `os.name`) and handles negated-property profiles correctly. This restores 3.9.x semantics. Tests include a jruby-style reproduction (#13390 regression) and a resteasy-style verification (#13084 non-regression). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
