Fix the inappropriate application of dependency management sections during dependency resolution.

sambsnyd · sambsnyd · commit 4df7f3af86fd · 2024-06-18T22:23:26.000-07:00
diff --git a/rewrite-maven/src/main/java/org/openrewrite/maven/tree/ResolvedPom.java b/rewrite-maven/src/main/java/org/openrewrite/maven/tree/ResolvedPom.java
@@ -825,9 +825,10 @@ public List<ResolvedDependency> resolveDependencies(Scope scope, Map<GroupArtifa
             List<DependencyAndDependent> dependenciesAtNextDepth = new ArrayList<>();
 
             for (DependencyAndDependent dd : dependenciesAtDepth) {
-                //First get the dependency (relative to the pom it was defined in)
-                Dependency d = dd.getDefinedIn().getValues(dd.getDependency(), depth);
-                //The dependency may be modified by the current pom's managed dependencies
+                // First get the dependency (relative to the pom it was defined in)
+                // Depth 0 prevents its dependency management from overriding versions of its own direct dependencies
+                Dependency d = dd.getDefinedIn().getValues(dd.getDependency(), 0);
+                // The dependency may be modified by the current pom's dependency management
                 d = getValues(d, depth);
                 try {
                     if (d.getVersion() == null) {
diff --git a/rewrite-maven/src/test/java/org/openrewrite/maven/MavenParserTest.java b/rewrite-maven/src/test/java/org/openrewrite/maven/MavenParserTest.java
@@ -2936,4 +2936,76 @@ void escapedA() {
           )
         );
     }
+
+    @Test
+    void transitiveDependencyManagement() {
+        rewriteRun(
+          mavenProject("depends-on-guava",
+            pomXml("""
+                <project>
+                    <modelVersion>4.0.0</modelVersion>
+                    <groupId>org.example</groupId>
+                    <artifactId>depends-on-guava</artifactId>
+                    <version>0.0.1</version>
+                    <dependencies>
+                        <dependency>
+                            <groupId>com.google.guava</groupId>
+                            <artifactId>guava</artifactId>
+                            <version>29.0-jre</version>
+                        </dependency>
+                    </dependencies>
+                    <dependencyManagement>
+                        <dependencies>
+                            <dependency>
+                                <groupId>com.google.guava</groupId>
+                                <artifactId>guava</artifactId>
+                                <version>30.0-jre</version>
+                            </dependency>
+                        </dependencies>
+                    </dependencyManagement>
+                </project>
+                """,
+              spec -> spec.afterRecipe(pom -> {
+                  //noinspection OptionalGetWithoutIsPresent
+                  List<ResolvedDependency> guava = pom.getMarkers().findFirst(MavenResolutionResult.class)
+                    .map(mrr -> mrr.findDependencies("com.google.guava", "guava", Scope.Compile))
+                    .get();
+
+                  assertThat(guava)
+                    .singleElement()
+                    .as("Dependency management cannot override the version of a direct dependency")
+                    .matches(it -> "29.0-jre".equals(it.getVersion()));
+              })
+            )),
+          mavenProject("transitively-depends-on-guava",
+            pomXml("""
+                <project>
+                    <modelVersion>4.0.0</modelVersion>
+                    <groupId>org.example</groupId>
+                    <artifactId>transitively-depends-on-guava</artifactId>
+                    <version>0.0.1</version>
+                    <dependencies>
+                        <dependency>
+                            <groupId>org.example</groupId>
+                            <artifactId>depends-on-guava</artifactId>
+                            <version>0.0.1</version>
+                        </dependency>
+                    </dependencies>
+                </project>
+                """,
+              spec -> spec.afterRecipe(pom -> {
+                  //noinspection OptionalGetWithoutIsPresent
+                  List<ResolvedDependency> guava = pom.getMarkers().findFirst(MavenResolutionResult.class)
+                    .map(mrr -> mrr.findDependencies("com.google.guava", "guava", Scope.Compile))
+                    .get();
+
+                  assertThat(guava)
+                    .singleElement()
+                    .as("The dependency management of dependency does not override the versions of its own direct dependencies")
+                    .matches(it -> "29.0-jre".equals(it.getVersion()));
+              })
+            )
+          )
+        );
+    }
 }
