apache / apache/maven-resolver

Non-thread-safe access in synchronized Results class in DependencyCollectorDelegate

Open
#1,995 0 comments 0 reactions 0 assignees View on GitHub
bug priority:minor
Dominant language
Java
Stars
152
Forks
160
Avg merge
1d 4h
Merged PRs (30d)
49

Description

**Affected version:** HEAD

**File:** `maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/collect/DependencyCollectorDelegate.java:571-598`

`addException()` and `addCycle()` are `synchronized` on `Results`, but they call `result.getExceptions()` and `result.getCycles()` on a `CollectResult` that may not be thread-safe. If `CollectResult`'s internal collections are not synchronized or safely published, concurrent modifications may not be visible.

Originally reported in #1944.

Contributor guide

No contributing guide indexed for this repository

Research direction

Read maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/collect/DependencyCollectorDelegate.java:571-598, focusing on Results.addException() and addCycle(). Trace how CollectResult exposes its exception and cycle collections, then verify the behavior under concurrent modification. Done means concurrent access is safely visible and the reported issue is resolved without changing unrelated collection behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.