Repository navigation
Update maven to 3.10.0 - #896
Merged
Merged
Conversation
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Maven 3.10.0 is the first release to bundle JLine's native terminal library (lib/jline-native/<OS>/<arch>/libjlinenative.so, 9 OS/arch builds plus a Windows DLL); bin/mvn points JLine at it with -Dlibrary.jline.path=$MAVEN_HOME/lib/jline-native. That failed minimal-check "output types valid" on both arches (the whole usr/share/maven tree was a data output) and drew 9 pkgscan HIGH "ELF executable in source" findings. The tarball is Apache's: its SHA-512 matches the published apache-maven-3.10.0-bin.tar.gz.sha512. - build.sh keeps only lib/jline-native/Linux/<host arch> (x86_64 / arm64), the one this package can load, at the path JLine resolves. - build.ncl declares it as an OutputLib and lets maven_home's data glob span it (allow_executable), the same split packages/jdk uses; adds glibc to runtime_deps for the dynamically linked .so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Member
|
/build |
The prebuilt JLine native lib was linked against a pre-2.34 glibc and NEEDs libutil.so.1 for openpty, its only libutil symbol. Since glibc 2.34 openpty is exported by libc at the same versions (GLIBC_2.2.5 on x86_64, GLIBC_2.17 on aarch64) and libutil.so.1 is an empty stub, so minimal-check's missing-runtime_deps reported openpty missing from it on both arches. The lib already NEEDs libc.so.6; patchelf --remove-needed drops the stale entry (patchelf added as a build dep). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Member
|
/build |
…, verified --remove-needed (9788003) dropped DT_NEEDED but left the version-needs entry "required from libutil.so.1: GLIBC_2.2.5", so the checker still saw libutil and the loader was left with a version requirement on a library it no longer loads -- which is why `mvn --version` started failing on both arches. --replace-needed renames the file in DT_NEEDED and .gnu.version_r alike, pointing the requirement at libc.so.6, which defines openpty@GLIBC_2.2.5 / @GLIBC_2.17 since glibc 2.34. build.sh now fails closed if either table still names libutil (patchelf --print-needed + objdump -p; binutils added as a build dep). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Member
|
/build |
bryan-minimal
marked this pull request as ready for review
October 16, 2026 20:06
bryan-minimal
approved these changes
Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update maven
3.9.16→3.10.0Source:
override:maven:operator-pinnedReleased: unknown (non-GitHub source or tag-only fallback)
Caution
Pkgscan: 10 new signals introduced by this update (risk score 45.1).
Diff against the prior version surfaced patterns that weren't present before. Review carefully before merging — supply-chain attacks land via version-bump injection.
lib/jline-native/Linux/armv6/libjlinenative.soanti-static-analysis/embedded-blobELF executable in source (ARM 32-bit — embedded target)lib/jline-native/Linux/x86_64/libjlinenative.soanti-static-analysis/embedded-blobELF executable in source (x86-64 — host arch)lib/jline-native/Linux/x86/libjlinenative.soanti-static-analysis/embedded-blobELF executable in source (x86 32-bit)lib/jline-native/Linux/arm64/libjlinenative.soanti-static-analysis/embedded-blobELF executable in source (aarch64 — host arch)lib/jline-native/Linux/arm/libjlinenative.soanti-static-analysis/embedded-blobELF executable in source (ARM 32-bit — embedded target)lib/jline-native/FreeBSD/x86_64/libjlinenative.soanti-static-analysis/embedded-blobELF executable in source (x86-64 — host arch)lib/jline-native/Linux/ppc64/libjlinenative.soanti-static-analysis/embedded-blobELF executable in source (PowerPC)lib/jline-native/Linux/armv7/libjlinenative.soanti-static-analysis/embedded-blobELF executable in source (ARM 32-bit — embedded target)lib/jline-native/FreeBSD/x86/libjlinenative.soanti-static-analysis/embedded-blobELF executable in source (x86 32-bit)maven (upstream release)metadata/recent-bumprecency NOT evaluated — no release date from the version sourceComponents changed
CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
maven3.9.163.10.0Changes
3.9.163.10.080ffca22aed9e8b9...a46cc51bc74fa23f...https://archive.apache.org/dist/maven/maven-3/3.9.16/binaries/apache-maven-3.9.16-bin.tar.gzhttps://archive.apache.org/dist/maven/maven-3/3.10.0/binaries/apache-maven-3.10.0-bin.tar.gzApache-2.0(source: tarball)Created by pkgmgr