[dxbjavid]

RandomStringGenerator keeps a reference to the Builder's filter set instead of copying it, and Builder.filteredBy(...) clears and refills that same set. So reusing a builder quietly changes generators that were already built from it:

RandomStringGenerator.Builder builder = RandomStringGenerator.builder().withinRange('0', 'z');
RandomStringGenerator password = builder.filteredBy(CharacterPredicates.LETTERS, CharacterPredicates.DIGITS).get();
builder.filteredBy(CharacterPredicates.DIGITS).get();
password.generate(12); // now digits only

For a password or token generator that is a silent drop in entropy (12 characters go from roughly 71 bits to 40). It also means a generator documented as thread-safe iterates a set the builder can still modify. The character list is already copied in the same constructor, so the predicates are now copied the same way.

testChangeOfFilterAfterGet fails without the main change (expected: <a> but was: <b>) and passes with it. The default mvn build is green locally on Java 21 (1990 tests, Checkstyle, PMD, SpotBugs, japicmp and Javadoc).

---

• Read the contribution guidelines for this project.
• Read the ASF Generative Tooling Guidance if you use Artificial Intelligence (AI).
• I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
• Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
• Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.