Maven: recover duplicate-resolved dependency edges hidden by the depgraph plugin#1730
Draft
saramaebee wants to merge 3 commits into
Draft
Maven: recover duplicate-resolved dependency edges hidden by the depgraph plugin#1730saramaebee wants to merge 3 commits into
saramaebee wants to merge 3 commits into
Conversation
…plugin Maven's dependency mediation attaches a package shared by several parents to a single winning parent. The depgraph plugin's aggregate goal only ever emits those winning edges (it hardcodes NodeResolution.INCLUDED), and its text format cannot express duplicates regardless of flags, so the CLI uploads a graph in which a shared transitive dependency appears exclusive to one parent. Downstream, dependency paths under-report who actually uses a shared package. Recover the omitted edges with a second, best-effort plugin invocation: the non-aggregating graph goal with showDuplicates=true emits JSON in which Maven's verbose graph reports the hidden edges as OMITTED_FOR_DUPLICATE. Those edges are merged into the aggregate output before the graph is built. On any failure the aggregate output is used unchanged, matching previous behavior. Edges are joined to artifacts via the JSON string ids: depgraph's numericId / numericFrom / numericTo use two unrelated counters and cannot be used as a join key. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X9wbLEaAC42dirqDFT7eEn
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X9wbLEaAC42dirqDFT7eEn
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X9wbLEaAC42dirqDFT7eEn
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Maven attaches a package shared by several parents to a single winning parent, and the depgraph plugin's
aggregategoal can only emit those winning edges — it hardcodesNodeResolution.INCLUDEDand has noshowDuplicatesoption, and its text format can't express duplicate edges regardless of flags. The uploaded graph therefore shows a shared transitive dependency under only one parent, and dependency paths under-report who actually uses it.This PR adds a best-effort second run of the plugin's
graphgoal with-DshowDuplicates=true(JSON output; runs per reactor module in onemvninvocation) and merges the recoveredOMITTED_FOR_DUPLICATEedges into the aggregate output before the graph is built. Any failure falls back to current behavior with a warning.Two details worth knowing: edges join to artifacts by string id because the plugin's
numericId/numericFrom/numericTouse unrelated counters; andOMITTED_FOR_CONFLICTedges are skipped since they point at losing versions the build doesn't ship.Acceptance criteria
Given
poi-ooxml -> log4j-apiplus a directlog4j-coredependency that also importslog4j-api,fossa analyzenow reports both parent edges instead of only Maven's winner, and dependency paths in the app show all real paths.Testing plan
cabal test unit-tests --test-options='-m "Maven"'— new specs cover the JSON decoding (including the numeric-id mismatch) and merge semantics (ignores INCLUDED edges and unknown artifacts, no self-edges, idempotent).fossa analyze -oon a demo project with the scenario above. Before:log4j-coreandpostgresqlhadimports: []. After:log4j-core -> log4j-apiandpostgresql -> checker-qualare present.Risks
One extra
mvninvocation per Maven analysis (plugin is already installed; failures are non-fatal by construction). The legacy 3.3.0 plugin path gets the same step and degrades gracefully if unsupported.Metrics
None added. The
Running plugin to recover duplicate-resolved edgescontext appears in debug bundles.References
Root-caused during a customer engagement where OEM-vendored transitive dependencies were mis-attributed to a single parent, breaking package-label workflows that rely on accurate dependency paths.
🤖 Generated with Claude Code