Skip to content

[Backport 4.0.x] [MNG-11147] Fix BOM version inference for sibling modules in dependencyManagement - #12569

Open
gnodet wants to merge 1 commit into
maven-4.0.xfrom
backport/11147-bom-version-inference
Open

[Backport 4.0.x] [MNG-11147] Fix BOM version inference for sibling modules in dependencyManagement#12569
gnodet wants to merge 1 commit into
maven-4.0.xfrom
backport/11147-bom-version-inference

Conversation

@gnodet

@gnodet gnodet commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Backport of #12416 to maven-4.0.x for inclusion in RC-6.

Version and groupId inference in transformFileToRaw was only applied to direct dependencies but not to dependencies declared in <dependencyManagement>. This caused installed consumer BOMs to be missing version tags for reactor sibling modules, making the BOM unusable by downstream consumers.

Extracts the inference loop into a reusable inferDependencies helper and applies it to both <dependencies> and <dependencyManagement>.

Closes #11147

…cyManagement

Version and groupId inference in transformFileToRaw was only applied to
direct dependencies but not to dependencies declared in
<dependencyManagement>. This caused installed consumer BOMs to be
missing version tags for reactor sibling modules, making the BOM
unusable by downstream consumers.

Extract the inference loop into a reusable inferDependencies helper and
apply it to both <dependencies> and <dependencyManagement>.

Closes #11147

Co-authored-by: Hiteshsai007 <hiteshsainiki007@gmail.com>
@gnodet gnodet added this to the 4.0.0-rc-6 milestone Jul 28, 2026

@gnodet gnodet left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

LGTM — Clean backport of merged PR #12416 to maven-4.0.x for RC-6.

The production code changes are content-identical to the original (already reviewed and approved). The refactoring correctly extracts version/groupId inference into a reusable inferDependencies helper and applies it to both <dependencies> and <dependencyManagement>, fixing the BOM version inference gap for reactor sibling modules.

Null safety is properly handled (depMgmt checked before access, newManagedDeps/newDeps only dereferenced when their changed flag is true). The included unit test validates the core scenario — a BOM subproject declaring a reactor sibling in dependencyManagement without a version tag.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of gnodet

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants