From da2b7aa4a9506ed0f5ace91810e019bebb11bf99 Mon Sep 17 00:00:00 2001 From: Guillaume Nodet Date: Mon, 27 Jul 2026 23:19:22 +0200 Subject: [PATCH 1/3] Bump Sisu to 1.1.0 and fix extension realm visibility for JSR330 filtering Sisu 1.1.0 adds JSR330 bean visibility filtering based on ClassRealm hierarchy (jsr330ComponentVisibilityFollowsPlexusVisibility, on by default). When TCCL is an extension realm during lifecycle callbacks, Sisu's FilteredBeans calls RealmManager.computeVisibleNames() which traverses parent and import realms via BFS. Extension realms have plexus.core as parent but beans discovered in the container are sourced from the maven.ext realm. Since extension realms had no import relationship to maven.ext, container-sourced beans were incorrectly filtered out. This caused failures with extensions like Mimir that register lifecycle listeners: when the listener's callback triggered a Sisu dynamic map access (e.g., NameMapper resolution), the beans were invisible from the extension's realm, resulting in "Unknown NameMapper name" errors. The fix adds a reverse import from each extension realm to the container realm (maven.ext), following the same pattern already used for the forward direction (maven.ext imports from extension realms). This makes maven.ext reachable in Sisu's visibility BFS traversal, so container-sourced beans remain visible regardless of TCCL context. Co-Authored-By: Claude Opus 4.6 --- .../maven/cling/invoker/PlexusContainerCapsuleFactory.java | 7 +++++++ pom.xml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/impl/maven-cli/src/main/java/org/apache/maven/cling/invoker/PlexusContainerCapsuleFactory.java b/impl/maven-cli/src/main/java/org/apache/maven/cling/invoker/PlexusContainerCapsuleFactory.java index f1290b02e574..a6db5a98139c 100644 --- a/impl/maven-cli/src/main/java/org/apache/maven/cling/invoker/PlexusContainerCapsuleFactory.java +++ b/impl/maven-cli/src/main/java/org/apache/maven/cling/invoker/PlexusContainerCapsuleFactory.java @@ -252,6 +252,13 @@ protected ClassRealm setupContainerRealm( // sisu uses realm imports to establish component visibility extRealm.importFrom(realm, realm.getId()); } + // Make the container realm (maven.ext) visible from extension realms. + // Beans discovered in the container are sourced from maven.ext, but extension + // realms have plexus.core as parent and cannot reach maven.ext through the parent + // chain alone. Without this import, Sisu 1.1.0's FilteredBeans (enabled by + // jsr330ComponentVisibilityFollowsPlexusVisibility) would hide container-sourced + // beans when TCCL is set to an extension realm during lifecycle callbacks. + realm.importFrom(extRealm, extRealm.getId()); } return extRealm; diff --git a/pom.xml b/pom.xml index 4098b8771a00..d817c824a614 100644 --- a/pom.xml +++ b/pom.xml @@ -165,7 +165,7 @@ under the License. 4.1.1 2.0.21 4.1.0 - 1.0.1 + 1.1.0 2.0.18 4.3.0 3.5.3 From db017a0069777cb364d8ea06873f7886eae51f8e Mon Sep 17 00:00:00 2001 From: Guillaume Nodet Date: Tue, 28 Jul 2026 10:26:34 +0200 Subject: [PATCH 2/3] Add IT for GH-12522: non-extension plugin JSR330 component leak Regression test verifying that plugins NOT marked with true do not cause build failures when they ship JSR330 components whose internal dependencies cannot be resolved in Maven's container. Uses tycho-bnd-plugin as the reproducer. With Sisu 1.1.0's jsr330ComponentVisibilityFollowsPlexusVisibility, non-extension plugin components are filtered out of container-realm JSR330 lookups, preventing the provisioning error. Co-Authored-By: Claude Opus 4.6 --- .../MavenITgh12522NonExtensionPluginTest.java | 65 +++++++++++++++++++ .../gh-12522-non-extension-plugin/pom.xml | 51 +++++++++++++++ 2 files changed, 116 insertions(+) create mode 100644 its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12522NonExtensionPluginTest.java create mode 100644 its/core-it-suite/src/test/resources/gh-12522-non-extension-plugin/pom.xml diff --git a/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12522NonExtensionPluginTest.java b/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12522NonExtensionPluginTest.java new file mode 100644 index 000000000000..48275f6b2845 --- /dev/null +++ b/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12522NonExtensionPluginTest.java @@ -0,0 +1,65 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.maven.it; + +import java.nio.file.Path; + +import org.junit.jupiter.api.Test; + +/** + * This is a test for GH-12522. + * + * Verifies that plugins that are NOT configured with {@code true} + * do not cause build failures when they ship JSR330 components whose internal dependencies + * cannot be resolved in Maven's container. + * + *

Prior to Sisu 1.1.0, {@code @Inject List} produced an unfiltered live list backed + * by the global {@code BeanLocator}, so JSR330 components discovered from non-extension + * plugin realms would leak into core Maven injection points (e.g. + * {@code List} in {@code LifecycleModuleBuilder}). Lazy + * provisioning of such components would fail when their plugin-internal dependencies + * were not bound in Maven's container, aborting the build.

+ * + *

Sisu 1.1.0's {@code jsr330ComponentVisibilityFollowsPlexusVisibility} feature applies + * realm-based filtering to JSR330 bean lookups, matching the filtering already applied + * by the Plexus compatibility layer. Non-extension plugin components are no longer + * visible from the container realm.

+ * + *

The reproducer uses {@code tycho-bnd-plugin} which ships a + * {@code ProjectExecutionListener} ({@code BndProjectExecutionListener}) as a + * {@code @Named} JSR330 component but is not configured as an extension in the POM.

+ */ +class MavenITgh12522NonExtensionPluginTest extends AbstractMavenIntegrationTestCase { + + /** + * Verify that a build using a plugin with JSR330 components (tycho-bnd-plugin) + * that is NOT marked as an extension completes successfully. With Sisu 1.1.0's + * realm-based JSR330 filtering, the plugin's {@code ProjectExecutionListener} + * is not visible from the container realm and should not be provisioned at all. + */ + @Test + void testNonExtensionPluginComponentsNotPickedUp() throws Exception { + Path testDir = extractResources("gh-12522-non-extension-plugin"); + + Verifier verifier = newVerifier(testDir.toString(), "remote"); + verifier.addCliArgument("process-classes"); + verifier.execute(); + verifier.verifyErrorFreeLog(); + } +} diff --git a/its/core-it-suite/src/test/resources/gh-12522-non-extension-plugin/pom.xml b/its/core-it-suite/src/test/resources/gh-12522-non-extension-plugin/pom.xml new file mode 100644 index 000000000000..67876ee793d0 --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12522-non-extension-plugin/pom.xml @@ -0,0 +1,51 @@ + + + + 4.0.0 + + org.apache.maven.its.gh12522 + non-extension-plugin + 1.0.0-SNAPSHOT + jar + + GH-12522 Non-Extension Plugin Test + Test that plugins NOT marked with extensions=true do not have their + JSR330/Plexus components picked up as extensions. Reproducer from + https://github.com/apache/maven/issues/12522 using tycho-bnd-plugin. + + + + + org.eclipse.tycho + tycho-bnd-plugin + 5.0.3 + + + bnd-process + + process + + process-classes + + + + + + From a26fbc714e8db8afe88c17bca4750924ab546acb Mon Sep 17 00:00:00 2001 From: Guillaume Nodet Date: Tue, 28 Jul 2026 12:53:13 +0200 Subject: [PATCH 3/3] Skip GH-12522 IT on JDK < 21 (tycho-bnd-plugin 5.0.3 requires Java 21) Co-Authored-By: Claude Opus 4.6 --- .../apache/maven/it/MavenITgh12522NonExtensionPluginTest.java | 3 +++ 1 file changed, 3 insertions(+) diff --git a/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12522NonExtensionPluginTest.java b/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12522NonExtensionPluginTest.java index 48275f6b2845..d7f7bc49c357 100644 --- a/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12522NonExtensionPluginTest.java +++ b/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12522NonExtensionPluginTest.java @@ -21,6 +21,8 @@ import java.nio.file.Path; import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.condition.EnabledForJreRange; +import org.junit.jupiter.api.condition.JRE; /** * This is a test for GH-12522. @@ -54,6 +56,7 @@ class MavenITgh12522NonExtensionPluginTest extends AbstractMavenIntegrationTestC * is not visible from the container realm and should not be provisioned at all. */ @Test + @EnabledForJreRange(min = JRE.JAVA_21, disabledReason = "tycho-bnd-plugin 5.0.3 requires Java 21") void testNonExtensionPluginComponentsNotPickedUp() throws Exception { Path testDir = extractResources("gh-12522-non-extension-plugin");