| When a Docker-based functional test runs on the standard flavor (@UITest(standardFlavor = true)) with the legacy profile, the generated WAR bundles both the legacy and the non-legacy version of the core extensions that the legacy distribution replaces. For example WEB-INF/lib contains both xwiki-platform-oldcore and xwiki-platform-legacy-oldcore, and both xwiki-platform-rendering-wikimacro-store and xwiki-platform-legacy-rendering-wikimacro-store. The real distribution WAR only contains the legacy versions. As a consequence, the tests don't run on the same core extensions as the users get, which defeats the purpose of the standard flavor mode. For example, a security scan of the extensions reports CVE-2025-49581 on xwiki-platform-rendering-wikimacro-store, which isn't part of the distribution WAR. Cause ArtifactResolver#getDistributionDependencies resolves the WAR dependencies root artifact (xwiki-platform-distribution-war-legacydependencies) together with some extra artifacts that the test framework needs (xwiki-platform-extension-handler-xar, xwiki-platform-flamingo-skin-resources, xwiki-platform-test-checker, xwiki-platform-search-solr-embedded, etc.). These extra artifacts are resolved next to the dependencies of the root artifact, so the exclusions that xwiki-platform-distribution-war-legacydependencies declares don't apply to them, and their transitive dependencies bring back the excluded JARs. For example:
- xwiki-platform-flamingo-skin-resources brings xwiki-platform-rendering-wikimacro-store (through xwiki-platform-index-tree-macro)
- xwiki-platform-extension-handler-xar, xwiki-platform-test-checker and xwiki-platform-search-solr-embedded bring xwiki-platform-oldcore
- xwiki-platform-extension-handler-xar is itself excluded by the legacy WAR dependencies, which bring xwiki-platform-legacy-extension-handler-xar instead
|
