Skip to content

Conversation

@gnodet
Copy link
Contributor

@gnodet gnodet commented Oct 28, 2025

Backport

This will backport the following commits from master to maven-4.0.x:

Questions ?

Please refer to the Backport tool documentation

…bdirectory (fixes apache#11321) (apache#11323)

This is a fix that adds validation to prevent reading parent POMs
that are located above the discovered root directory. This prevents
infinite loops when a .mvn directory exists in a subdirectory and
Maven is invoked with -f pointing to that subdirectory.

The fix includes:
- Validation in doReadFileModel() to check parent POM location
- Validation in getEnhancedProperties() to prevent infinite loops
- Helper method isParentWithinRootDirectory() for path validation
- Integration test to reproduce and verify the fix

(cherry picked from commit 714fc51)
The integration test for apacheGH-11321 needs to specify that it only runs
on Maven 4.0.0 and later, since the fix is only available in those
versions. This prevents the test from running on older Maven versions
where the fix is not present, which was causing CI failures.

The test validates that Maven properly rejects setups where a parent
POM is located above the root directory when a .mvn directory exists
in a subdirectory.
@gnodet gnodet merged commit b7f9178 into apache:maven-4.0.x Oct 29, 2025
37 of 38 checks passed
@github-actions github-actions bot added this to the 4.0.0 milestone Oct 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport bug Something isn't working mvn40

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant