Skip to content

Fix inherited versions in BOM consumer POMs - #12710

Open
ulofiai wants to merge 1 commit into
apache:masterfrom
ulofiai:fix/issue-12660
Open

Fix inherited versions in BOM consumer POMs#12710
ulofiai wants to merge 1 commit into
apache:masterfrom
ulofiai:fix/issue-12660

Conversation

@ulofiai

@ulofiai ulofiai commented Aug 8, 2026

Copy link
Copy Markdown

Fixes #12660.

When building a consumer model, retain locally declared dependency-management metadata while filling a missing version from an imported BOM. The merge is limited to BUILD_CONSUMER, so regular model import precedence and conflicting BOM imports remain unchanged.

Adds a focused regression test for a versionless managed dependency with an overridden scope.

Signed-off-by: ulofiai <monsterking@tutamail.com>

@gnodet gnodet left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean, well-scoped fix that correctly fills in missing dependency versions from imported BOMs in consumer POM generation. The change is narrowly guarded to BUILD_CONSUMER mode only and includes a focused unit test.

Notes:

  • The five-predicate guard (present != null, directDependencies.contains(key), BUILD_CONSUMER request type, present.getVersion() == null, dependency.getVersion() != null) ensures this only activates for the exact scenario reported in #12660.
  • No file overlap with related PR #12641, so no merge conflict risk.
  • An end-to-end integration test (similar to PR #12641's its/core-it-suite/ approach) could add extra confidence, but is not blocking.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of gnodet

@gnodet gnodet left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean, well-scoped fix that correctly fills missing dependency versions from imported BOMs during consumer POM generation. The five-predicate guard ensures this only activates for the exact scenario reported in #12660, and the unit test covers the primary use case.

Non-blocking observations:

  • Consider adding negative test cases: one that verifies the version is NOT filled in for non-BUILD_CONSUMER request types, and another that verifies an existing local version is NOT overridden by a BOM version.
  • No CI checks have run on this PR (merge state shows UNSTABLE). The fix should be verified via CI before merging.

This review was generated by an AI agent (Claude Code) and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of Guillaume Nodet

gnodet added a commit to gnodet/maven that referenced this pull request Aug 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Artifact defined in a BOM project results in entry without version which is inherited from a parent

2 participants