[maven-4.0.x] DefaultDependencyResolver: unbounded per-instance module caches

[elharo]

DefaultDependencyResolver: Unbounded per-instance module caches

Found in: maven-4.0.x branch
File: impl/maven-impl/src/main/java/org/apache/maven/impl/resolver/DefaultDependencyResolver.java (lines 81, 86-89, 97-98)
Severity: Medium

Description

The class is @Singleton but the moduleCaches map holds PathModularizationCache instances that are never cleaned up:

private final Map<Runtime.Version, PathModularizationCache> moduleCaches;

public DefaultDependencyResolver() {
    moduleCaches = new ConcurrentHashMap<>();
}

Each unique Runtime.Version creates a new cache entry that stays in memory for the lifetime of the JVM. The TODOs on lines 78 and 87 acknowledge this should be session-wide. This is a memory leak in long-running build environments (e.g., Maven in server mode, IDE integration).

[elharo]

It's not obvious that there are or ever will be enough different unique Runtime.Versions to make this remotely relevant.