apache / apache/maven-remote-resources-plugin

getProjects() mutates the project's resolved Artifact versions (side effect)

Open
#268 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
17
Forks
18
Avg merge
6h 5m
Merged PRs (30d)
5

Description

## Summary
`getProjects()` mutates the version of each artifact while filtering/iterating dependencies, and for the non-aggregate `process` mojo these are the live instances from `project.getArtifacts()`.

`src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java:509-575`

```java
for (Artifact artifact : artifacts) {
if (artifact.isSnapshot()) {
artifact.setVersion(artifact.getBaseVersion()); // mutates shared object
}
...
}
```

`artifacts` is a `new LinkedHashSet<>(getAllDependencies())` — a copy of the *set*, but the `Artifact` objects inside are the same references. `ProcessRemoteResourcesMojo.getAllDependencies()` returns `project.getArtifacts()` directly (`ProcessRemoteResourcesMojo.java:65-67`), so `setVersion(...)` rewrites the version of the project's resolved artifacts (e.g. stripping the timestamp from a timestamped snapshot to its base version).

## Impact
A side effect on the in-memory project model: later build steps that read `project.getArtifacts()` (or `session.getProjects()` in the aggregate case) see the modified versions. This is triggered only when a template references `$projects`/`$projectsSortedByOrganization`, making it a non-obvious, order-dependent mutation.

## Suggested fix
Avoid mutating the shared instances — build a new `DefaultArtifact` (or copy) with the base version, or use the base version only for model building without calling `setVersion` on the original.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java:509-575 and trace ProcessRemoteResourcesMojo.getAllDependencies() at lines 65-67 to confirm which Artifact instances are shared. Verify the change through the project and aggregate processing paths; done means filtering no longer changes versions observed through project.getArtifacts() or session.getProjects().

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.