Skip to content

[Backport 4.0.x] Fix getDispatchedPaths() leaking mutable nested lists - #13057

Merged
gnodet merged 1 commit into
maven-4.0.xfrom
cherry-pick-13039-to-4.0.x
Sep 6, 2026
Merged

[Backport 4.0.x] Fix getDispatchedPaths() leaking mutable nested lists#13057
gnodet merged 1 commit into
maven-4.0.xfrom
cherry-pick-13039-to-4.0.x

Conversation

@gnodet

@gnodet gnodet commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

Backport of #13039 from master to maven-4.0.x.

@gnodet gnodet added this to the 4.0.0-rc-7 milestone Sep 6, 2026
@gnodet gnodet added fix bug Something isn't working and removed fix labels Sep 6, 2026
The outer map returned by DependencyResolverResult.getDispatchedPaths()
was unmodifiable, but the List<Path> values were the internal ArrayList
instances. Callers could mutate those lists and desynchronize the
correlated paths, dispatchedPaths, and dependencies views.

Wrap each nested list as well as the outer map before returning, while
preserving PathType and path insertion order.

Signed-off-by: Robert McConnell <robert@mcc0nnell.org>
@gnodet
gnodet force-pushed the cherry-pick-13039-to-4.0.x branch from 7f73b91 to acb96b7 Compare September 6, 2026 20:03
@gnodet
gnodet merged commit e2dbbd9 into maven-4.0.x Sep 6, 2026
1 of 2 checks passed
@gnodet
gnodet deleted the cherry-pick-13039-to-4.0.x branch September 6, 2026 20:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants