GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Stacked on #1716, since both change how the Maven extension walks a module's graph.

Maven Socket facts kept only Maven 3's five scopes and silently dropped every other dependency, subtree included. That covered Maven 4's compile-only, test-only, test-runtime and none, and an import or misspelled scope in <dependencies>. Maven 3 compiles and runs against such a jar, so this was both an SBOM miss and a reachability blind spot.

What changes

• A scope Maven 3 doesn't define is prod, as Maven 3 puts its jar on every classpath. A scope Maven 4 doesn't define follows the same rule, as Maven 4's default plugins do.
• Maven 4's compile-only, test-only and test-runtime are dev, on the compile or test path its PathScope gives them.
• Maven 4's none is on no path. The dependency and its subtree stay in the SBOM as dev, in a root that a new noClasspath record marks. The assembler leaves them off the reachability classpath and the sidecar's direct dependencies, so Coana neither analyses nor fetches them.
• --include-configs and --exclude-configs match any scope name.

These rules follow a measured comparison: Maven 3.9.9 and 4.0.0-rc-6, and the CycloneDX Maven plugin, cdxgen, Trivy and Syft. The decisions are recorded in REA-1164.

Verification

• New maven-compat/unknown-scopes fixture, on every Maven version: import and misspelled scopes, each with a child. Prod, on the classpath.
• New maven-compat/maven4-scopes fixture, on the Maven 4 row: the four Maven 4 scopes, plus a none dependency sharing a child with a compile one, whose edge is kept.
• The previous extension misses both.
• Maven compat matrix 3.2.5 to 4.0.0-rc-6 is green.

Resolves REA-1164.

🤖 Generated with Claude Code