Add pom.xml index support to MavenBndRepository

[Copilot]

This allows to specify an .xml file which is interpreted as a (flat) pom.xml file for the index (instead of the flat text file). This could make it easier for to work with tools like dependabot which know pom.xml but not the flat text file of bnd.

Note that this pom.xml is very simple (only considers the <depedency> entries) and flat and will also be overwritten / recreated when using the "Update Mbr" of the Repobrowser or mbr CLI command (in other words: it can destroy existing maven files. so make sure you are using a dedicated pom.xml file here, which is only used for bnd workspaces)

The IndexFile used by MavenBndRepository auto-detects if the index is an XML file and if yes, try to parse it as a pom.xml file. So you basically can continue using your existing index file name and just put pom.xml content in it.

But note: It should be a very simplistic "pom-like" pom.xml . Not all features are supported. Only the the <depedency> entries matter.

Example

Let's say instead of a central.mvn text file you want to maintain a pom.xml:

You can just put that in your index in /ext/pom.xml in your bnd workspace and use it in a repo like below:

-plugin.Testing: \
    aQute.bnd.repository.maven.provider.MavenBndRepository; \
        snapshotUrl=http://repository.apache.org/snapshots/; \
        releaseUrl=https://repo.maven.apache.org/maven2/; \
        index=./ext/pom.xml; \
        readOnly=true; \
        name="Testing Bundles"

See https://bnd.bndtools.org/plugins/maven.html

This pull request was created from Copilot chat.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR adds pom.xml support for MavenBndRepository index files, enabling automatic detection based on the .xml file extension. It introduces a new POMIndexFile helper class for reading/writing pom.xml format, refactors MbrUpdater to use a new replaceArchive method on IndexFile, and adds secure XML processing to XML.java. The changes ensure that archives with non-jar extensions and classifiers are correctly round-tripped through <type> and <classifier> elements.

Changes:

• New POMIndexFile utility class for reading Maven pom.xml dependencies and writing them back with proper <type>/<classifier> support, preserving project-level metadata.
• IndexFile gains an isPom flag (auto-detected from filename), branching read/save for pom.xml vs text formats, and a new replaceArchive method for atomic archive replacement.
• MbrUpdater.update() refactored from manual file I/O to use IndexFile.replaceArchive(), making it format-agnostic.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
POMIndexFile.java	New helper class with readFromPom and savePom static methods for pom.xml index I/O
IndexFile.java	Added isPom flag, pom.xml branching in read/save, new replaceArchive method, renamed save → saveText for text format
MbrUpdater.java	Simplified update() to delegate to IndexFile.replaceArchive() instead of manual file manipulation
XML.java	Added FEATURE_SECURE_PROCESSING as defense-in-depth for XML parsing
MavenBndRepoTest.java	Five new tests for pom.xml index: read, add, remove, replace, metadata preservation, and type/classifier support
index.pom.xml	New test resource mirroring index.maven content in pom.xml format