Filter transitive dependencies with uninterpolated expressions#12084
Open
gnodet wants to merge 1 commit into
Open
Filter transitive dependencies with uninterpolated expressions#12084gnodet wants to merge 1 commit into
gnodet wants to merge 1 commit into
Conversation
When a transitive dependency POM contains dependencies with
uninterpolated property expressions (e.g., ${osgi.version}), the
MavenValidator.validateDependency() throws IllegalArgumentException
during dependency collection.
Filter out such dependencies in DefaultArtifactDescriptorReader
.populateResult() before they reach the resolver/validator, following
the same pattern used for transitive repositories with uninterpolated
IDs/URLs (commit 9332ad3).
This is safe because invalid dependencies from build POMs have already
been rejected during model validation. Uninterpolated expressions in
transitive dependency POMs indicate undefined properties in those
third-party POMs that cannot be resolved.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet
added a commit
that referenced
this pull request
May 18, 2026
When a transitive dependency POM contains dependencies with
uninterpolated property expressions (e.g., ${osgi.version}), the
MavenValidator.validateDependency() throws IllegalArgumentException
during dependency collection.
Filter out such dependencies in DefaultArtifactDescriptorReader after
populateResult() runs, before they reach the resolver/validator,
following the same pattern used for transitive repositories with
uninterpolated IDs/URLs (commit 9332ad3).
This is safe because invalid dependencies from build POMs have already
been rejected during model validation. Uninterpolated expressions in
transitive dependency POMs indicate undefined properties in those
third-party POMs that cannot be resolved.
Cherry-pick of #12084, adapted for the 4.0.x delegate pattern.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet
added a commit
that referenced
this pull request
May 19, 2026
When a transitive dependency POM contains dependencies with
uninterpolated property expressions (e.g., ${osgi.version}), the
MavenValidator.validateDependency() throws IllegalArgumentException
during dependency collection.
Filter out such dependencies in DefaultArtifactDescriptorReader after
populateResult() runs, before they reach the resolver/validator,
following the same pattern used for transitive repositories with
uninterpolated IDs/URLs (commit 9332ad3).
This is safe because invalid dependencies from build POMs have already
been rejected during model validation. Uninterpolated expressions in
transitive dependency POMs indicate undefined properties in those
third-party POMs that cannot be resolved.
Cherry-pick of #12084, adapted for the 4.0.x delegate pattern.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet
added a commit
that referenced
this pull request
May 19, 2026
When a transitive dependency POM contains dependencies with
uninterpolated property expressions (e.g., ${osgi.version}), the
MavenValidator.validateDependency() throws IllegalArgumentException
during dependency collection.
Filter out such dependencies in DefaultArtifactDescriptorReader after
populateResult() runs, before they reach the resolver/validator,
following the same pattern used for transitive repositories with
uninterpolated IDs/URLs (commit 9332ad3).
This is safe because invalid dependencies from build POMs have already
been rejected during model validation. Uninterpolated expressions in
transitive dependency POMs indicate undefined properties in those
third-party POMs that cannot be resolved.
Cherry-pick of #12084, adapted for the 4.0.x delegate pattern.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet
added a commit
that referenced
this pull request
May 19, 2026
When a transitive dependency POM contains dependencies with
uninterpolated property expressions (e.g., ${osgi.version}), the
MavenValidator.validateDependency() throws IllegalArgumentException
during dependency collection.
Filter out such dependencies in DefaultArtifactDescriptorReader after
populateResult() runs, before they reach the resolver/validator,
following the same pattern used for transitive repositories with
uninterpolated IDs/URLs (commit 9332ad3).
This is safe because invalid dependencies from build POMs have already
been rejected during model validation. Uninterpolated expressions in
transitive dependency POMs indicate undefined properties in those
third-party POMs that cannot be resolved.
Cherry-pick of #12084, adapted for the 4.0.x delegate pattern.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
${...}expressions inDefaultArtifactDescriptorReader.populateResult()before they reach the resolver/validatorIllegalArgumentException: Not fully interpolated dependencywhen a transitive POM contains dependencies with undefined property expressions (e.g.,org.osgi:osgi.core:jar:${osgi.version})Context
Maven 4's
MavenValidator.validateDependency()rejects dependencies with uninterpolated property expressions. This is correct for the project's own POMs (caught during model validation), but transitive dependency POMs from Maven Central may contain managed dependencies with expressions that are not resolvable outside their original build context. These should be silently filtered rather than causing a build failure.This is the resolver-side complement to #12083 (mvnup fix for project-local POMs with undefined property expressions).
Test plan
mvn test -B -pl impl/maven-impl— 462 tests passmvn test -B -pl compat/maven-resolver-provider— 27 tests passorg.osgi:osgi.core:jar:${osgi.version})🤖 Generated with Claude Code