(maven-site) branch master updated: Document the 256-character maximum version string length (#1663)

[gn...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

gnodet pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/maven-site.git


The following commit(s) were added to refs/heads/master by this push:
     new 3b8212a6 Document the 256-character maximum version string length (#1663)
3b8212a6 is described below

commit 3b8212a62e07b72d6fc80a74ee72fa2ad3e79126
Author: Guillaume Nodet <gn...@gmail.com>
AuthorDate: Thu Sep 3 11:30:20 2026 +0200

    Document the 256-character maximum version string length (#1663)
    
    The ComparableVersion parser now rejects version strings longer than
    256 characters to prevent stack overflow from deep nesting and
    quadratic BigInteger parsing. Document this limit in the naming
    conventions guide.
    
    Co-authored-by: Claude Opus 4.6 <no...@anthropic.com>
---
 content/markdown/guides/mini/guide-naming-conventions.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/content/markdown/guides/mini/guide-naming-conventions.md b/content/markdown/guides/mini/guide-naming-conventions.md
index 3e407e53..de841e7e 100644
--- a/content/markdown/guides/mini/guide-naming-conventions.md
+++ b/content/markdown/guides/mini/guide-naming-conventions.md
@@ -109,6 +109,18 @@ Examples
 2.3.4+15433
 ```
 
+### Maximum version length
+
+Version strings are limited to **256 characters**. This bound prevents
+pathological inputs from causing excessive resource consumption during
+version parsing: the recursive parser can nest one frame per separator,
+and digit runs beyond 18 characters are parsed into `BigInteger` at
+quadratic cost. The limit of 256 characters is far beyond any
+real-world version identifier (the longest versions observed on Maven
+Central are around 25 characters) while keeping the nesting depth and
+numeric items small. A version string that exceeds this limit will
+cause an `IllegalArgumentException` at parse time.
+
 ### Unstable versions (SNAPSHOT)
 
 `SNAPSHOT`s are artifacts built in between releases.