apache / apache/maven-remote-resources-plugin

RemoteResourcesClassLoader is created per execution and never closed

Open Beginner friendly
#273 0 comments 0 reactions 0 assignees View on GitHub
bug priority:minor
Dominant language
Java
Stars
17
Forks
18
Avg merge
6h 5m
Merged PRs (30d)
5

Description

## Summary
`initalizeClassloader()` constructs a fresh `RemoteResourcesClassLoader` (a `URLClassLoader`) for every mojo execution and never closes it.

`src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java:865-875`

```java
private ClassLoader initalizeClassloader(List artifacts) throws MojoExecutionException {
RemoteResourcesClassLoader cl = new RemoteResourcesClassLoader(null);
try {
for (File artifact : artifacts) {
cl.addURL(artifact.toURI().toURL());
}
return cl;
} catch (MalformedURLException e) {
throw new MojoExecutionException("Unable to configure resources classloader: " + e.getMessage(), e);
}
}
```

## Impact
`URLClassLoader` holds open file handles (jar URL connections, caches). In long-running builds that execute this mojo many times (e.g. aggregator + forked lifecycles, or the documented double-execute pattern), the unclosed classloaders retain jar file descriptors until GC — the references are dropped after `execute()`, but not closed deterministically. Minor resource leak / handle retention.

## Suggested fix
Call `cl.close()` when the classloader is no longer needed (after `processResourceBundles`, before restoring the original context classloader in `execute()`), or use try-with-resources around its lifetime. Note `RemoteResourcesClassLoader.getResource` intentionally delegates after `findResource`, so closing it is safe once processing completes.

Contributor guide

No contributing guide indexed for this repository

Research direction

Read src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java around initalizeClassloader() and execute(), then trace processResourceBundles to identify the classloader's full lifetime. Done means the RemoteResourcesClassLoader is closed deterministically after processing and before the original context classloader is restored, without changing resource processing behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.