You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "elharo (via GitHub)" <gi...@apache.org> on 2026/08/02 11:01:26 UTC
[I] SerializingDependencyNodeVisitor holds mutable depth state and is not thread-safe/reentrant [maven-dependency-tree]
elharo opened a new issue, #139:
URL: https://github.com/apache/maven-dependency-tree/issues/139
## Summary
`SerializingDependencyNodeVisitor` keeps traversal state in instance fields (`depth`), mutated in `visit(...)`/`endVisit(...)` and read in `getTree(...)`. This makes the visitor neither thread-safe nor safely reentrant:
- Two threads sharing one visitor instance interleave and corrupt the indentation output.
- The same visitor reused for two separate graphs carries stale `depth` between runs.
## Affected code
`src/main/java/org/apache/maven/shared/dependency/graph/traversal/SerializingDependencyNodeVisitor.java`
- `depth` field: line 53
- mutated in `visit(...)`: lines 113-118 and `endVisit(...)`: lines 132-133
- read in `getTree(...)`: lines 89-96
## Impact
`SerializingDependencyNodeVisitor` is the type exposed by `DefaultDependencyNode.getTree(...)`; any caller that reuses or shares the visitor across nodes/threads gets garbled or incorrect output.
## Suggested fix
Make the depth state local to each traversal (e.g. pass a per-run state object through the visitor, or document that each traversal must use a fresh instance), and add a test showing reuse produces correct output.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SerializingDependencyNodeVisitor holds mutable depth state and is not thread-safe/reentrant [maven-dependency-tree]
Posted by "slachiewicz (via GitHub)" <gi...@apache.org>.
slachiewicz closed issue #139: SerializingDependencyNodeVisitor holds mutable depth state and is not thread-safe/reentrant
URL: https://github.com/apache/maven-dependency-tree/issues/139
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] SerializingDependencyNodeVisitor holds mutable depth state and is not thread-safe/reentrant [maven-dependency-tree]
Posted by "slachiewicz (via GitHub)" <gi...@apache.org>.
slachiewicz commented on issue #139:
URL: https://github.com/apache/maven-dependency-tree/issues/139#issuecomment-6004161752
Closing: maven-dependency-tree is no longer used by any Apache Maven component and is planned for retirement, tracked in #150 ([vote](https://lists.apache.org/thread/xvqh2pjm8zq6k2h6kogzlksv37rzkcbx)). No further releases are planned. To migrate, call Maven Resolver directly, as #150 describes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org