apache / apache/maven-resolver
Non-thread-safe access in synchronized Results class in DependencyCollectorDelegate
- Dominant language
- Java
- Stars
- 152
- Forks
- 160
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 49
Description
**Affected version:** HEAD
**File:** `maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/collect/DependencyCollectorDelegate.java:571-598`
`addException()` and `addCycle()` are `synchronized` on `Results`, but they call `result.getExceptions()` and `result.getCycles()` on a `CollectResult` that may not be thread-safe. If `CollectResult`'s internal collections are not synchronized or safely published, concurrent modifications may not be visible.
Originally reported in #1944.
Contributor guide
No contributing guide indexed for this repository
Research direction
Read maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/collect/DependencyCollectorDelegate.java:571-598, focusing on Results.addException() and addCycle(). Trace how CollectResult exposes its exception and cycle collections, then verify the behavior under concurrent modification. Done means concurrent access is safely visible and the reported issue is resolved without changing unrelated collection behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100