GeezerVison

Heads up, reviewer

We have been missing maven edges in dynamic SBOMs as the APIs for some reason only report dependencies as children of the first parent in the tree/graph rather than all the parents.

LLM Description written by Claude Code:claude-opus-5-5

Maven Socket facts now include every dependency edge Maven resolves, as Gradle and sbt facts already do. Before, an edge onto a dependency Maven kept elsewhere was dropped: jetty-io -> jetty-util when jetty-util is also a direct dependency, or an edge Maven mediated to another version. Dependency chains therefore missed paths to a package.

What changes

• The extension wraps Maven's own graph transformer, records each node's children before conflict resolution, and points every edge at the node Maven kept for that conflict. No version choice is made outside Maven.
• Roots are shaped like Gradle's runtime and test classpaths: the test root is the module's whole resolution, the compile root the nodes Maven kept with a prod scope. An edge from a prod node onto a provided one is kept, and the provided dependency stays dev.
• Prod/dev now follows the scope Maven kept a node with, replacing the reachability split from fix(manifest): keep Maven components reachable from their root #1549. A dependency Maven widens to compile under a test parent is prod, as it is on Maven's runtime classpath.
• A module whose conflict resolution fails (unsatisfiable hard version ranges) is reported unscannable and emits and fetches nothing. It used to emit the half-resolved candidates, including several versions of one package.

No facts format, assembler or Coana change.

Verification

• Maven compat matrix 3.2.5, 3.6.3, 3.8.8, 3.9.9, 4.0.0-rc-6 green. New fixture cases (edge onto a direct dependency, mediated edge, prod onto provided, unsolvable conflict) all fail with the v1.x extension.
• Records are identical with and without aether.conflictResolver.verbose.
• socket fix --dynamic-sbom-inference on a Maven reactor with a vulnerable package reached both directly and transitively gives the same fix as before.

🤖 Generated with Claude Code