Validate metadata inputs across legacy and new API paths, clone proxies before decryption - #12945

Merged

gnodet merged 8 commits into

apache:maven-4.0.xfrom

slachiewicz:pr/legacy-compat-4.0.x

Sep 1, 2026

Commits on Aug 30, 2026

Fail closed on metadata checksum mismatches under the fail policy
slachiewicz
committed
57fa740
Thread the configured checksum policy through two legacy metadata fetches
slachiewicz
committed
9326805
Validate repository key and metadata version tokens on the legacy path
slachiewicz
committed
1a20766
Clone proxy before decrypting its password
slachiewicz
committed
ba38de8
Validate the repository key used in legacy metadata file names
slachiewicz
committed
9d03e0f

Commits on Sep 1, 2026

Validate metadata inputs and relocation coordinates in the new API resolvers

gnodet
and
claude
committed
e1d9a85
Address review: fix @since tag, simplify validateVersionToken, replace NUL bytes

gnodet
and
claude
committed
b243384
Merge maven-4.0.x after Set 3 merge: resolve conflicts keeping MetadataInputValidator

gnodet
and
claude
committed
9729066