apache / apache/maven-remote-resources-plugin
getProjects() mutates the project's resolved Artifact versions (side effect)
- Dominant language
- Java
- Stars
- 17
- Forks
- 18
- Avg merge
- 6h 5m
- Merged PRs (30d)
- 5
Description
## Summary
`getProjects()` mutates the version of each artifact while filtering/iterating dependencies, and for the non-aggregate `process` mojo these are the live instances from `project.getArtifacts()`.
`src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java:509-575`
```java
for (Artifact artifact : artifacts) {
if (artifact.isSnapshot()) {
artifact.setVersion(artifact.getBaseVersion()); // mutates shared object
}
...
}
```
`artifacts` is a `new LinkedHashSet<>(getAllDependencies())` — a copy of the *set*, but the `Artifact` objects inside are the same references. `ProcessRemoteResourcesMojo.getAllDependencies()` returns `project.getArtifacts()` directly (`ProcessRemoteResourcesMojo.java:65-67`), so `setVersion(...)` rewrites the version of the project's resolved artifacts (e.g. stripping the timestamp from a timestamped snapshot to its base version).
## Impact
A side effect on the in-memory project model: later build steps that read `project.getArtifacts()` (or `session.getProjects()` in the aggregate case) see the modified versions. This is triggered only when a template references `$projects`/`$projectsSortedByOrganization`, making it a non-obvious, order-dependent mutation.
## Suggested fix
Avoid mutating the shared instances — build a new `DefaultArtifact` (or copy) with the base version, or use the base version only for model building without calling `setVersion` on the original.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java:509-575 and trace ProcessRemoteResourcesMojo.getAllDependencies() at lines 65-67 to confirm which Artifact instances are shared. Verify the change through the project and aggregate processing paths; done means filtering no longer changes versions observed through project.getArtifacts() or session.getProjects().
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100