You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maven.apache.org by gn...@apache.org on 2026/05/19 07:26:18 UTC
(maven) branch fix/downgrade-classworlds-2.9.0 created (now d9987e73dd)
This is an automated email from the ASF dual-hosted git repository.
gnodet pushed a change to branch fix/downgrade-classworlds-2.9.0
in repository https://gitbox.apache.org/repos/asf/maven.git
at d9987e73dd Downgrade plexus-classworlds from 2.11.0 to 2.9.0
This branch includes the following new commits:
new d9987e73dd Downgrade plexus-classworlds from 2.11.0 to 2.9.0
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(maven) 01/01: Downgrade plexus-classworlds from 2.11.0 to 2.9.0
Posted by gn...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
gnodet pushed a commit to branch fix/downgrade-classworlds-2.9.0
in repository https://gitbox.apache.org/repos/asf/maven.git
commit d9987e73dddb38967ee8ec3f7d959da87b8b9468
Author: Guillaume Nodet <gn...@gmail.com>
AuthorDate: Tue May 19 09:26:09 2026 +0200
Downgrade plexus-classworlds from 2.11.0 to 2.9.0
Classworlds 2.11.0 introduced a bug in ConfigurationParser.loadGlob
where the glob file filter uses || (OR) instead of && (AND), causing
patterns like "maven-*.jar" to match all jars. On Linux ext4, where
File.listFiles() returns non-deterministic ordering, this leads to
unpredictable classloading order and class collisions between
maven-embedder and sisu-plexus (PlexusXmlBeanConverter), breaking
lifecycle configuration injection.
Fix: https://github.com/codehaus-plexus/plexus-classworlds/pull/147
Co-Authored-By: Claude Opus 4.6 <no...@anthropic.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 13ef71e0f8..456083d34c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -145,7 +145,7 @@ under the License.
<assertjVersion>3.27.7</assertjVersion>
<asmVersion>9.9.1</asmVersion>
<byteBuddyVersion>1.18.8</byteBuddyVersion>
- <classWorldsVersion>2.11.0</classWorldsVersion>
+ <classWorldsVersion>2.9.0</classWorldsVersion>
<commonsCliVersion>1.11.0</commonsCliVersion>
<guiceVersion>5.1.0</guiceVersion>
<guavaVersion>33.6.0-jre</guavaVersion>