BOM Packging does not resolve the versions in BOM subproject

[khmarbaise]

Affected version

Maven 4.0.0-rc4, Maven 4.0.0 (e668ec4), Maven 4.1.0 (d9824a8)

Bug description

I have create a multi project setup which contains three subprojects.

• Packaging bom (bom)
• Packaging jar (mod-1)
• Packaging jar (mod-2)
  and a parent which defines them as subprojects like this (only excerpts full setup in example project https://github.com/khmarbaise/maven-bugs/blob/master/maven-4.0/bom-example/pom.xml):

  <groupId>com.soebes.examples.maven4</groupId>
  <artifactId>bom-example</artifactId>
  <version>${revision}</version>
  <name>Maven 4 :: BOM</name>
  <packaging>pom</packaging>
...
  <subprojects>
    <subproject>mod-1</subproject>
    <subproject>mod-2</subproject>
    <subproject>bom</subproject>
  </subprojects>

and the BOM packaging module like this: https://github.com/khmarbaise/maven-bugs/blob/master/maven-4.0/bom-example/bom/pom.xml

<project xmlns="http://maven.apache.org/POM/4.1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.1.0 https://maven.apache.org/xsd/maven-4.1.0.xsd">

  <parent>
    <groupId>com.soebes.examples.maven4</groupId>
    <artifactId>bom-example</artifactId>
  </parent>

  <packaging>bom</packaging>
  <artifactId>bom</artifactId>
  <name>Maven 4 :: BOM :: MOD BOM</name>
  <dependencyManagement>
    <dependencies>
      <dependency>
          <groupId>com.soebes.examples.maven4</groupId>
          <artifactId>mod-1</artifactId>
      </dependency>
      <dependency>
          <groupId>com.soebes.examples.maven4</groupId>
          <artifactId>mod-2</artifactId>
      </dependency>
    </dependencies>
  </dependencyManagement>
</project>

I've tested the project to be built with the following Maven versions:

• Maven 4.0.0-rc-4 (bed0f81)
• Maven 4.0.0 (maven-4.0.x-branch GitHash: e668ec4)
• Maven 4.1.0-SNAPSHOT (master-branch GitHash: d9824a8)

like this:

mvn -Dmaven.repo.local=$(pwd)/.repo  clean install 

(The usage of a local repos is not relevant here):
The resulting BOM in the cache being installed looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.soebes.examples.maven4</groupId>
  <artifactId>bom</artifactId>
  <version>1.0.0-SNAPSHOT</version>
  <packaging>pom</packaging>
  <name>Maven 4 :: BOM :: MOD BOM</name>
  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>com.soebes.examples.maven4</groupId>
        <artifactId>mod-1</artifactId>
      </dependency>
      <dependency>
        <groupId>com.soebes.examples.maven4</groupId>
        <artifactId>mod-2</artifactId>
      </dependency>
      <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter</artifactId>
        <version>5.10.2</version>
      </dependency>
      <dependency>
...

So unfortunately it misses the version for the mod-1 and mod-2 artifact. The version tag defined for the pom itself is correct..

[gnodet]

Maven 4 does not infer version on managed dependencies, only on dependencies.
You may want to try something like https://github.com/maveniverse/bom-builder-maven-plugin.

[Hiteshsai007]

I have investigated the root cause of this issue and submitted a PR to fix it.

What was happening

The issue lies in DefaultModelBuilder.transformFileToRaw(). During the transformation from the file model to the raw model, the builder checks for missing versions and group IDs (so it can infer them from the reactor). However, this inference logic was only being applied to the project's <dependencies>. It completely skipped <dependencyManagement>, meaning any sibling module dependencies managed in a BOM POM would be left without a version.

The Fix

I updated transformFileToRaw to also iterate through model.getDependencyManagement().getDependencies(), applying the same inferDependencyVersion and inferDependencyGroupId logic.

I tested this locally against the provided bom-example reproducer, and the installed consumer POM now correctly populates the versions (<version>1.0.0-SNAPSHOT</version>) as expected.

Link to PR: #12416