You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "gnodet (via GitHub)" <gi...@apache.org> on 2026/10/13 11:22:39 UTC
[PR] Fix #13459: support package-private configuration classes in plugins [maven]
gnodet opened a new pull request, #13470:
URL: https://github.com/apache/maven/pull/13470
## Problem
`AbstractConfigurationConverter.instantiateObject()` (from `org.eclipse.sisu.plexus`) uses `Class.newInstance()` which requires a **public** no-arg constructor. This prevents using package-private classes (or static inner classes with non-public constructors) as `@Parameter` configuration types in Maven 4 API plugins — an `IllegalAccessException` is thrown at configuration time.
This was discovered while working on removing the `maven-archiver` dependency from `maven-jar-plugin` (apache/maven-jar-plugin#618): the plugin's `ArchiveConfiguration` type would benefit from being a package-private class but currently cannot be used as a `@Parameter` type.
Fixes #13459.
## Solution
`EnhancedConfigurationConverter` already overrides `fromConfiguration()`, which is the call site of `instantiateObject()`. Since `instantiateObject` is `protected final` in `AbstractConfigurationConverter` (from sisu, not overridable), we replace the call with a local `instantiate()` method that uses:
```java
var ctor = type.getDeclaredConstructor();
if (!ctor.canAccess(null)) {
ctor.setAccessible(true);
}
return ctor.newInstance();
```
This is **symmetric** with how `EnhancedCompositeBeanHelper.setFieldValue()` already handles non-public fields (via `field.setAccessible(true)`). The fix makes constructor instantiation consistent with field injection.
## Alternative
A one-line fix in `eclipse-sisu/sisu.plexus`'s `AbstractConfigurationConverter.instantiateObject()` would be the cleanest long-term solution, but that requires a sisu release cycle. This Maven-side fix is immediately actionable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix #13459: support package-private configuration classes in plugins [maven]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #13470:
URL: https://github.com/apache/maven/pull/13470#discussion_r4274973912
##########
impl/maven-core/src/main/java/org/apache/maven/configuration/internal/EnhancedConfigurationConverter.java:
##########
@@ -111,6 +111,19 @@ public Object fromConfiguration(
}
}
+ private static Object instantiate(Class<?> type, PlexusConfiguration configuration)
Review Comment:
The parent class has a method `instantiateObject`, but it's `protected final`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix #13459: support package-private configuration classes in plugins [maven]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet merged PR #13470:
URL: https://github.com/apache/maven/pull/13470
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix #13459: support package-private configuration classes in plugins [maven]
Posted by "desruisseaux (via GitHub)" <gi...@apache.org>.
desruisseaux commented on code in PR #13470:
URL: https://github.com/apache/maven/pull/13470#discussion_r4275501831
##########
impl/maven-core/src/main/java/org/apache/maven/configuration/internal/EnhancedConfigurationConverter.java:
##########
@@ -111,6 +111,19 @@ public Object fromConfiguration(
}
}
+ private static Object instantiate(Class<?> type, PlexusConfiguration configuration)
Review Comment:
Yes but `protected final` method can be used in subclasses. Maybe the same should be done for `instantiate`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix #13459: support package-private configuration classes in plugins [maven]
Posted by "desruisseaux (via GitHub)" <gi...@apache.org>.
desruisseaux commented on code in PR #13470:
URL: https://github.com/apache/maven/pull/13470#discussion_r4274934981
##########
impl/maven-core/src/main/java/org/apache/maven/configuration/internal/EnhancedConfigurationConverter.java:
##########
@@ -111,6 +111,19 @@ public Object fromConfiguration(
}
}
+ private static Object instantiate(Class<?> type, PlexusConfiguration configuration)
Review Comment:
I'm not familiar with this part of the code, so maybe my remark will be irrelevant. But the `instantiateObject` method is apparently inherited from the parent class. Maybe this new `instantiate` method should be added next to it. Then:
* Check if `instantiateObject` is still used and, if not, remove it.
* This pull request said that this change is "symmetric with `EnhancedCompositeBeanHelper.setFieldValue`". If symmetric, then can the latter method share the new `instantiate` method introduced by this pull request (if that method can put moved to the parent class)?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix #13459: support package-private configuration classes in plugins [maven]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #13470:
URL: https://github.com/apache/maven/pull/13470#issuecomment-6346148995
<!-- maven-backport-bot -->
**Backport PRs created:**
- ✅ `maven-4.0.x` → #13685
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix #13459: support package-private configuration classes in plugins [maven]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #13470:
URL: https://github.com/apache/maven/pull/13470#issuecomment-6346054801
<!-- maven-backport-bot -->
**Conflicts — manual resolution needed:**
- ❌ `maven-4.0.x`: Cherry-pick conflict in:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix #13459: support package-private configuration classes in plugins [maven]
Posted by "gnodet-bot (via GitHub)" <gi...@apache.org>.
gnodet-bot commented on code in PR #13470:
URL: https://github.com/apache/maven/pull/13470#discussion_r4258038504
##########
impl/maven-core/src/main/java/org/apache/maven/configuration/internal/EnhancedConfigurationConverter.java:
##########
@@ -111,6 +111,19 @@ public Object fromConfiguration(
}
}
+ private static Object instantiate(Class<?> type, PlexusConfiguration configuration)
+ throws ComponentConfigurationException {
+ try {
+ var ctor = type.getDeclaredConstructor();
+ if (!ctor.canAccess(null)) {
+ ctor.setAccessible(true);
+ }
+ return ctor.newInstance();
+ } catch (ReflectiveOperationException e) {
Review Comment:
⚠️ **Missing test for the fixed scenario.**
This PR fixes a real bug (`Class.newInstance()` requiring a public constructor) but adds no test. A future regression would be silent. Please add a unit test in `maven-core` that:
1. Defines a class with a **package-private no-arg constructor** (e.g. a static inner class in the test)
2. Runs it through `EnhancedConfigurationConverter.fromConfiguration()` (or directly calls `instantiate()` via reflection)
3. Asserts the instance is created without `ComponentConfigurationException`
Without this, CI cannot catch a regression to the old `instantiateObject()` call.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix #13459: support package-private configuration classes in plugins [maven]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #13470:
URL: https://github.com/apache/maven/pull/13470#discussion_r4350324006
##########
impl/maven-core/src/main/java/org/apache/maven/configuration/internal/EnhancedConfigurationConverter.java:
##########
@@ -111,6 +111,19 @@ public Object fromConfiguration(
}
}
+ private static Object instantiate(Class<?> type, PlexusConfiguration configuration)
Review Comment:
The parent class comes from Plexus Configuration. The plan is to get rid of it, see https://github.com/apache/maven/issues/13528. This PR is just about a quick fix for 4.0.x line.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org