Commit Graph

3109 Commits

Author SHA1 Message Date
Michael Osipov f164ab5f89 [MNG-7513] Address commons-io_commons-io vulnerability found in maven latest version
We can safely remove Commons IO altogether because it is not used in any direct or
transitive usecase at compile time or runtime.

This closes #771
2022-07-18 17:31:06 +02:00
Sylwester Lachiewicz e4f347ed85 [MNG-6965] Extensions suddenly have org.codehaus.plexus:plexus-utils:jar:1.1 on their classpath
This closes #367
2022-06-24 19:10:33 +02:00
Slawomir Jaranowski b3e7e57e4b [MNG-7504] Don't print warning unsupported reportPlugins for m-site-p 2022-06-20 23:59:02 +02:00
Guillaume Nodet 115febf29b [MNG-7160] Ability to customize core extensions classloaders (#616) 2022-06-18 12:30:40 +02:00
Slawomir Jaranowski 0504c361b4 [MNG-7468] Check unsupported plugins parameters in configuration - 3.9
(cherry picked from commit 54f9d91ebb)
2022-06-06 17:23:15 +02:00
Guillaume Nodet 0a94ff769c [MNG-7476] Display a warning when an aggregator mojo is locking other mojos executions 2022-05-30 13:10:42 +02:00
Guillaume Nodet 0b0a96782e [MNG-7487] Fix deadlock during forked lifecycle executions
# Conflicts:
#	maven-core/src/main/java/org/apache/maven/lifecycle/internal/MojoExecutor.java
2022-05-30 13:10:25 +02:00
Guillaume Nodet aec341a7a9 [MNG-7486] Create a multiline message helper for boxed log messages
This closes #746
2022-05-29 13:34:53 +02:00
Tamas Cservenak 70e9381a74 [MNG-7478] Transport selection should use config properties (#739)
Instead of user properties, as this allows making "permanent" the
selection by using MAVEN_OPTS and other places as well. Currently
only via command line works.

Also, do not modify existing Maven behavior, so introduce "default" branch
in selection. See comment in code
2022-05-17 08:58:21 +02:00
Tamas Cservenak 4de39476ff [MNG-7471] Make Resolver util and connector-basic provided (#732)
Problem: resolver spi, impl and connector-basic has changes in 1.8.0 (SPI interface RepositoryLayout got new method, that is implemented in connector-basic, and code from impl is using it). But, Maven core exports only resolver api, spi and impl packages, while the rest is at mercy of a plugin. This means ,that these artifacts (api, spi and impl) will always come from Maven core, whatever version plugin declares, while the "rest" (connector-basic and util) will be of version that plugin declares. The current state hence prevented ANY KIND of changes on SPI interfaces that would be implemented in connector-basic (which is the case in Resolver 1.8.0).

Solution: make all these resolver artifacts "provided" (to behave like maven-core or maven-plugin-api is behaving): simply put, whatever resolver artifact plugin depends on, it should NOT use it's own version, but the version from Maven. This ensures that api-spi-impl-connector-basic as "aligned" and are same version.

Details:

The change is to make util is exportedArtifact AND exportedPackage, while connector-basic is only exportedArtifact.

Reasoning:
* exportedArtifact -- prevents "own" artifact to be added to realm
* exportedPackage -- makes it "visible" in realm

So, this basically prevents bad versions of util and connector-basic
enter the plugin realm (as they will be not added to it), while
util remains "visible" to plugins, as the intent was, most
common due GenericVersions etc.

This change also results in simpler expectations to plugin developers:
resolver libraries should really behave like maven-core or maven-compat:
when plugin declares dependency on these (w/ scope provided as best
practice), they really get version of these that are of version that
maven runs in, not version they declare. So same thing happens now with
resolver: you will get same version of resolver that maven uses your plugin
runs in.

Before this change, it was a mixed bag: api, spi and impl was from maven,
while util and connector-basic was version you pulled in as dep.
2022-05-11 16:06:37 +02:00
Guillaume Nodet 89237dd74d Revert "[MNG-7347] SessionScoped beans should be singletons for a given session (#653)" (#715)
This reverts commit b4518b5fe4.
2022-05-09 10:04:54 +02:00
Slawomir Jaranowski 74eba2968b [MNG-7464] Warn about using read-only parameters for Mojo in configuration
(cherry picked from commit 3dd0afd897)
2022-05-06 23:05:12 +02:00
Slawomir Jaranowski dd0ddef8f6 [MNG-7457] Warn about deprecated plugin Mojo
(cherry picked from commit 702f52d0ea)
2022-04-24 13:49:26 +02:00
Slawomir Jaranowski 28c763c72c [MNG-5222] Improvement in deprecated params detection
This is backport of commit 9ac2d08dc7 from master to maven-3.9.x branch.
2022-04-23 12:29:41 +02:00
Tamas Cservenak 4c9dc5abb2
[MNG-7055] Fix G level metadata handling in 3.9.x (#691)
Maven Artifact Transfer silently prevents group level metadata to reach Resolver and causes metadata loss on install/deploy.
Fix is to "bridge" this from maven-resolver-provider (and core) by reusing the actual metadata that
m-plugin-p:addPluginArtifactMetadata mojo adds, but m-a-t filters out.

This is backport of commit d141957ff5 from master to maven-3.9.x branch.
2022-04-22 17:51:07 +02:00
Tamas Cservenak 85caf98029 [MNG-7454] Include resolver-transport-http in Maven (#720)
Addendum to 1ad5a1b1e9bb0a17fc12bbe0314564a616078602:
* fix property name to align with existing ones
* fix logging configuration as no more shaded httpClient
* fix constant names
2022-04-16 18:21:48 +02:00
Hervé Boutemy 3c6009cbf4 [MNG-7438] add execution id to "configuring mojo" debug message
[DEBUG] Configuring mojo execution
'org.apache.maven.plugins:maven-surefire-plugin:3.0.0-M5:test:default-test'
with basic configurator

rephrase "Configuring" to "Loading" mojo "from plugin realm"
to differentiate from "configuring mojo" = apply configuration

rename populatePluginFields(..) private method
to populateMojoExecutionFields(..) to better match the intent
2022-04-15 18:40:52 +02:00
Tamas Cservenak 1ad5a1b1e9
[MNG-7454] Include resolver-transport-http in Maven 3.9.x (#710)
But keep Wagon as default transport. This PR merely includes
resolver http and file transport and switches wagon-http
to non-shaded one.

Changes:
* switch to non-shaded wagon-http (as httpClient is now shared)
* include resolver http and file transport
* override resolver default behaviour (native transport preferred over wagon, when both on classpath)
* provide simplistic means to choose transport

The chosen transport can be seen in debug (-X) output on line
`[DEBUG] Using transporter XXX...`

The `-Dmaven.transport` simplistic switch can be used to choose transport:
* not set: default, that is Wagon
* `wagon`: explicitly sets Wagon
* `resolver`: explicitly sets resolver native transports (file and http)
* `auto`: relies on resolver "auto discovery" (priorities, etc). This is MUST to keep transport pluggable with 3rd party transports. In fact, this was the default so far in Maven, along with the fact that native resolver transports were not included (as resolver prefers native ones over Wagon).
2022-04-13 12:51:19 +02:00
Gabriel Belingueres ff0300b7cf
[MNG-5222] Maven 3 no longer logs warnings about deprecated plugin parameters
- Added warning when setting deprecated parameter with value different
than the default.
- Changed Logger to SLF4J.

(cherry picked from commit c99028b9fb)
2022-04-12 22:49:03 +02:00
Tamas Cservenak 08dff22a41
[MNG-7447] Fix ReactorReader unintended change (#709)
The commit c604db3c3a
changed ReactorReader to use MavenSession#getAllProjects()
instead of deprecated MavenSession#getProjectMap() that
is equivalent of MavenSession#getProjects().

This undoes this unintended change.
2022-04-08 18:24:03 +02:00
Tamas Cservenak 263cf9542b [MNG-7432] Resolver session contains non-MavenWorkspaceReader (#695)
As Resolver session contains non-MavenWorkspaceReader, the reactor models (already resolved w/ profiles applied) are re-built when using Resolver within Mojo, instead to get them via ReactorReader as expected. The rebuilt models will lack explicit (-P on CLI) profiles applied, as resolver itself is not maven aware, hence there is no way to "tell" resolver to apply them. Building reactor models w/ profiles applied is NOT done using resolver, but by Maven when loading up reactor, as profiles are NOT applied for downstream transitive dependencies (see discussion on MNG-1388 why).

Signed-off-by: Christoph Läubrich <christoph@laeubi-soft.de>
Co-authored-by: Christoph Läubrich <christoph@laeubi-soft.de>
Co-authored-by: Tamas Cservenak <tamas@cservenak.net>
2022-04-08 10:32:15 +02:00
Karl Heinz Marbaise c604db3c3a
[MNG-7447] - Several Improvements by using Stream API 2022-04-05 21:24:58 +02:00
Jacky f7b073f3eb
[MNG-7445] - Refactoring, remove the useless line
Contribution by JakcyHu Gakiii

Signed-off-by: Karl Heinz Marbaise <khmarbaise@apache.org>
2022-04-01 22:21:36 +02:00
Guillaume Nodet 3a5a40c6d2
[MNG-7391] Fix MojosExecutionStrategy lookup to be able to look into the SessionScope (#692) 2022-03-15 06:55:50 +01:00
Guillaume Nodet 14ca723438 [MNG-7350] Introduce a factory for ModelCache 2022-03-09 13:33:45 +01:00
Guillaume Nodet 1954d51ff2 [MNG-7391] add execution strategy+runner required by Maven Build Cache 2022-03-09 10:33:40 +01:00
mickroll a55300a588 [MNG-6972] Allow access to org.apache.maven.graph
This is, for example, needed for rebuilding the dependency graph during build
extension execution after changing dependencies.

This closes #368
2022-03-06 21:12:47 +01:00
Michael Osipov 6b7beb4db8 [MNG-7019] Notify also at start when profile is missing 2022-03-06 21:12:47 +01:00
boris-unckel e1b46e2339 [MNG-7068] Active dependency management for Google Guice/Guava
This closes #462
2022-03-06 20:46:56 +01:00
Michael Osipov 78ca83e2a4 Bump version to 3.9.0-SNAPSHOT 2022-03-06 10:46:56 +01:00
Michael Osipov 0a6f12fba1 [maven-release-plugin] prepare for next development iteration 2022-03-05 12:41:16 +01:00
Michael Osipov 3599d3414f [maven-release-plugin] prepare release maven-3.8.5 2022-03-05 12:41:04 +01:00
Michael Osipov cfeea9dac4 Remove unused imports 2022-03-05 12:39:24 +01:00
Michael Osipov f0caf9c9b3 [MNG-6960] Use RuntimeInformation instead of reading properties 2022-02-27 19:31:35 +01:00
Christoph Läubrich d29af9018b [MNG-7402] BuildListCalculator never detaches the classloader
This closes #683
2022-02-26 21:40:28 +01:00
Sylwester Lachiewicz 395411fe31 [MNG-7417] Several classes do not set properties properly for building requests
This closes #306
2022-02-20 19:27:59 +01:00
Christoph Läubrich 6f14196846 [MNG-7400] Allow more WorkspaceReaders to participate
This closes #668
2022-02-13 10:41:06 +01:00
Guillaume Nodet d79485ff23
[MNG-6727] Using version range in parent and CI Friendly Version fails 2022-02-01 14:26:54 +01:00
Guillaume Nodet 83257bfde0
[MNG-7349] Limit relocation warning message to direct dependencies only 2022-01-24 07:53:26 +01:00
Falko Modler 67ff805448 [MNG-7381] Shorten parallel builder thread name to artifactId, conditionally with groupId
This closes #663
2022-01-17 22:16:39 +01:00
Falko Modler 99de6b49ee [MNG-7380] Don't log non-threadsafe warning if only building a single module
This closes #655
2022-01-11 15:45:53 +01:00
Guillaume Nodet b4518b5fe4
[MNG-7347] SessionScoped beans should be singletons for a given session (#653) 2022-01-10 08:19:41 +01:00
Michael Osipov 05b748ff6a [MNG-5561] Plugin relocation loses configuration
Previously, to locate plugin configuration in the project the plugin descriptor
was read and the GA were extracted. This always worked because the GA from the
model and the GA from plugin descriptor (plugin.xml) were identical. When a
plugin is relocated the target artifact is read, thus its plugin descriptor as
well. Naturally, the GA of new (relocated) does not correspond to the old
(static) one in the model. Therefore, the configuration is not found.
New approach is to use the original plugin GA to locate the configuration in
the model regardless of relocation.
2021-12-30 17:05:02 +01:00
Guillaume Nodet 4ff27db4f9 [MNG-7156][MNG-7285] Fix typo in test 2021-12-17 08:57:42 +01:00
Guillaume Nodet 10a72f30f7
[MNG-7156][MNG-7285] Add locking in MojoExecutor (#628) 2021-12-17 08:42:18 +01:00
Michael Osipov 8af0a674db [maven-release-plugin] prepare for next development iteration 2021-11-14 10:14:54 +01:00
Michael Osipov 9b656c72d5 [maven-release-plugin] prepare release maven-3.8.4 2021-11-14 10:14:42 +01:00
Michael Osipov 5c36bf5ef7 [MNG-7312] Revert ThreadLocal approach from MNG-6843 and MNG-7251
Revert "[MNG-7251] Fix threadLocalArtifactsHolder leaking into cloned project"

This reverts commit 4e5b3d5554.

Revert "[MNG-6843] Parallel build fails due to missing JAR artifacts in compilePath"

This reverts commit 76d5f0d942.

===

This closes #595
2021-10-22 21:58:12 +02:00
Michael Osipov 21e597ec77 [maven-release-plugin] prepare for next development iteration 2021-09-27 20:28:37 +02:00
Michael Osipov ff8e977a15 [maven-release-plugin] prepare release maven-3.8.3 2021-09-27 20:28:25 +02:00
Guillaume Nodet 0a6bbb8301 [MNG-7235] Speed improvements when calculating the sorted project graph
This closes #530
2021-09-27 20:18:53 +02:00
George Gastaldi ab54d17dc2 [MNG-7253] Display relocation message defined in model
Move logging to DefaultArtifactDescriptorReader

This closes #544
2021-09-18 20:54:05 +02:00
Michael Osipov d1aa1e1f0a [MNG-7252] Fix warnings issued by dependency:analyze
This closes #541
2021-09-16 11:54:33 +02:00
Romain Manni-Bucau 93f9e85955 [MNG-7045] Drop CDI API from Maven
This closes #540
2021-09-15 16:40:00 +02:00
Guillaume Nodet 98a9d089bd [MNG-7236] The DefaultPluginVersionResolver should cache results for the session 2021-09-14 20:09:40 +02:00
Michael Osipov 1ea42b0371 [MNG-7219] [Regression] plexus-cipher missing from transitive dependencies 2021-09-14 19:23:22 +02:00
Falko Modler 4e5b3d5554 [MNG-7251] Fix threadLocalArtifactsHolder leaking into cloned project
This closes #527
2021-09-14 17:28:24 +02:00
Tamas Cservenak e08834b79e [MNG-7250] Upgrade Sisu Inject/Plexus to 0.3.5
Since we have replaced the old JSR 250 library with javax.annotation library we
go straight to 1.2.

This closes #539
2021-09-13 23:24:06 +02:00
Michael Osipov 383cabf9e4 [MNG-7216] [Regression] Revert MNG-7170
This reverts commit 5a89973126.

This closes #524
2021-09-12 16:42:13 +02:00
Tamas Cservenak c76c9d9116 [MNG-7246] Upgrade Plexus Cipher and Sec Dispatcher to 2.0
Both plexus-cipher and plexus-sec-dispatcher have had a
groupId change, but plexus-cipher change was implemented
for 1.8 version.

Latest versions of artifacts are 2.0. This PR
ups plexus-cipher version and adds proper changes
for plexus-sec-dispatcher groupId change.

This closes #534
2021-09-11 10:53:52 +02:00
Michael Osipov 865dcaa6ff [maven-release-plugin] prepare for next development iteration 2021-08-04 21:03:42 +02:00
Michael Osipov ea98e05a04 [maven-release-plugin] prepare release maven-3.8.2 2021-08-04 21:03:30 +02:00
Michael Osipov 268f956574 Use proper term: directory 2021-07-19 23:47:10 +02:00
Michael Osipov a3907fcb2b [MNG-6754] Set the same timestamp in multi module builds
Reuse MavenExecutionRequest#getStartTime() throughout for snapshot versions,
last updated fields in metadata consistently for local and remote repositories
for the entire reactor and its modules.

This closes #381
2021-07-12 19:47:14 +02:00
Romain Manni-Bucau f32c3dba94 [MNG-6471] Parallel builder should use the module name as thread name
This closes #177
2021-07-12 19:42:57 +02:00
Michael Osipov 8b693cc992 Document hacks as such 2021-07-02 17:51:17 +02:00
Artem Krosheninnikov 9ae1d95a58 [MNG-6844] Use StandardCharsets and remove outdated @SuppressWarnings
This closes #312
2021-07-02 14:53:16 +02:00
huangkaifeng 2a2392f15e [MNG-6873] Align JUnit version to 4.13
Closes #331
2021-07-02 14:50:25 +02:00
Michael Osipov b5ee583381 [MNG-6859] Build not reproducible when built from source release
This closes #322
2021-07-02 14:02:05 +02:00
Artem Krosheninnikov a659ade9a0 [MNG-6827] Replace deprecated StringUtils#defaultString() from Plexus Utils
This closes #302
2021-07-02 10:46:56 +02:00
Karl Heinz Marbaise 6f5c3d57a6 [MNG-6872] - Found CVEs in your dependencies - plexus-utils (tests) 2021-07-02 10:40:32 +02:00
Olivier Lamy 41efc134a9 [MNG-6886] upgrade plexus-cipher to 1.8 and update changed groupId (#335)
Signed-off-by: olivier lamy <olamy@apache.org>
2021-07-02 10:28:16 +02:00
Mickael Istria 5a89973126 [MNG-7170] Allow to associate pomFile/${basedir} with DefaultProjectBuilder.build(ModelSource, ...)
Actually a subset backport of MNG-5669 (5cdb8332f9)

Also-By: rfscholte <rfscholte@apache.org>

This closes #478
2021-06-27 00:33:40 +02:00
Artem Krosheninnikov d4ad077ef5 [MNG-6816] Prefer System.lineSeparator() over system properties
This closes #300
2021-06-26 23:41:16 +02:00
Falko Modler 76d5f0d942 [MNG-6843] Parallel build fails due to missing JAR artifacts in compilePath
Signed-off-by: rfscholte <rfscholte@apache.org>
(cherry picked from commit 73e00ed85d)

This closes #482
2021-06-26 22:40:14 +02:00
Artem Krosheninnikov 863f9193e6 [MNG-6842] ProjectBuilderTest uses Guava, but Guava is not defined in dependencies
This closes #311
2021-06-26 22:24:17 +02:00
Sylwester Lachiewicz b5056e4188 [MNG-6828] DependencyResolutionException breaks serialization 2021-06-26 22:17:45 +02:00
pazderski 3645593bfa [MNG-6983] Plugin key can get out of sync with artifactId and groupId
The plugin key is build as combination of artifactId and groupId but not
updated if either of these two ids change.
This can be a problem if artifactId or groupId is a variable. The calculated
key will likely contain the unresolved property and is not updated once the
variable is interpolated.

This closes #372
2021-06-26 21:19:56 +02:00
olivier lamy 66a4381377 [MNG-5868] No duplicate artifacts in attached artifacts
if attached artifacts already contains the artifact remove it and add the new one

Signed-off-by: olivier lamy <olamy@apache.org>
2021-06-26 20:56:05 +02:00
rfscholte 5213f43df1 [maven-release-plugin] prepare for next development iteration 2021-03-30 19:15:13 +02:00
rfscholte 05c21c65bd [maven-release-plugin] prepare release maven-3.8.1 2021-03-30 19:14:35 +02:00
Hervé Boutemy d295dc362f [MNG-7128] keep blocked attribute from mirrors in artifact repositories 2021-03-25 23:51:26 +01:00
Hervé Boutemy a46906806a next version in branch 3.8.x is 3.8.1-SNAPSHOT 2021-03-24 19:33:13 +01:00
rfscholte dad8a3e1c5 [maven-release-plugin] prepare for next development iteration 2021-03-21 22:31:55 +01:00
rfscholte 6aa1f4acf5 [maven-release-plugin] prepare release maven-3.8.0 2021-03-21 22:31:24 +01:00
Hervé Boutemy 899465aeec [MNG-7117] add support for blocked mirror 2021-03-19 20:43:01 +01:00
Hervé Boutemy fa79cb22e4 [MNG-7116] add support for mirrorOf external:http:* 2021-03-19 20:42:49 +01:00
Michael Osipov e2891667dd Bump version to 3.8.0-SNAPSHOT 2021-03-16 17:59:50 +01:00
rfscholte cecedd3430 [maven-release-plugin] prepare release maven-3.6.3 2019-11-19 20:17:06 +01:00
Robert Scholte c82409a2d8
[MNG-6759] Maven fails to use <repositories> section from dependency when resolving transitive dependencies in some cases 2019-11-17 22:10:01 +01:00
Hervé Boutemy 53ccee3486 [MNG-6778] use https for schema location 2019-11-09 13:45:14 +01:00
Christian Wansart 0c7c69f78b [MNG-6778] - Use https for maven schemaLocations 2019-11-07 16:16:39 +01:00
Hervé Boutemy bd10f00b68 [MNG-6789] upgrade and configure plugins for Reproducible Builds
- packaging plugins (source, jar, assembly) 3.2.0
- plexus-metadata 2.1.0
- sisu.inject 3.3.4
2019-11-07 13:35:52 +01:00
rfscholte 3f3d775ede Rewrite assertTrue to assertThat to get more meaningful messages 2019-10-13 15:33:42 +02:00
Stig Rohde Døssing db3e44694c [MNG-6759] - Fix issue where MavenMetadataSource failed to set the right repositories when preparing artifact metadata 2019-10-12 18:54:44 +02:00
rfscholte 38efe8444c Fix checkstyle reported errors 2019-09-10 18:51:18 +02:00
Dezhi Cai d09bc7437f [refactor] use utility method of Objects to simplify code (#284)
* [refactor] use utility method of Objects to simplify code

* [refactor] use utility method of Objects to simplify code
2019-09-10 16:22:22 +10:00
rfscholte 3eb242c571 [MNG-6760] ExclusionArtifactFilter result invalid when wildcard exclusion is followed by other exclusions 2019-09-07 14:24:21 +02:00
Enrico Olivelli d9a0eee7fe [maven-release-plugin] prepare for next development iteration 2019-08-27 16:59:23 +02:00
Enrico Olivelli 40f5233313 [maven-release-plugin] prepare release maven-3.6.2 2019-08-27 16:59:01 +02:00