getProjects() mutates the project's resolved Artifact versions (side effect)

[elharo]

Summary

getProjects() mutates the version of each artifact while filtering/iterating dependencies, and for the non-aggregate process mojo these are the live instances from project.getArtifacts().

src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java:509-575

for (Artifact artifact : artifacts) {
    if (artifact.isSnapshot()) {
        artifact.setVersion(artifact.getBaseVersion());   // mutates shared object
    }
    ...
}

artifacts is a new LinkedHashSet<>(getAllDependencies()) — a copy of the set, but the Artifact objects inside are the same references. ProcessRemoteResourcesMojo.getAllDependencies() returns project.getArtifacts() directly (ProcessRemoteResourcesMojo.java:65-67), so setVersion(...) rewrites the version of the project's resolved artifacts (e.g. stripping the timestamp from a timestamped snapshot to its base version).

Impact

A side effect on the in-memory project model: later build steps that read project.getArtifacts() (or session.getProjects() in the aggregate case) see the modified versions. This is triggered only when a template references $projects/$projectsSortedByOrganization, making it a non-obvious, order-dependent mutation.

Suggested fix

Avoid mutating the shared instances — build a new DefaultArtifact (or copy) with the base version, or use the base version only for model building without calling setVersion on the original.