Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fail to update Maven packages with properties in their names #1238

Open
michaelkedar opened this issue Sep 11, 2024 · 0 comments
Open

Fail to update Maven packages with properties in their names #1238

michaelkedar opened this issue Sep 11, 2024 · 0 comments
Labels
bug Something isn't working guided remediation Related to guided remediation / osv-scanner fix

Comments

@michaelkedar
Copy link
Member

If a Maven dependency uses a property in its artifactId or groupId, the writer does not find the original definition of the package and will end up creating a new section for the patch.

e.g. Starting with this:

<properties>
  <artifact>foo</artifact>
</properties>
<dependencies>
  <dependency>
    <groupId>com.xyz</groupId>
    <artifactId>${artifact}</artifactId>
    <version>1.0.0</version>
  </dependency>
</dependencies>

A patch to com.xyz:foo will end up looking like:

<properties>
  <artifact>foo</artifact>
</properties>
<dependencies>
  <dependency>
    <groupId>com.xyz</groupId>
    <artifactId>${artifact}</artifactId>
    <version>1.0.0</version>
  </dependency>
</dependencies>
<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.xyz</groupId>
      <artifactId>foo</artifactId>
      <version>2.0.0</version>
    </dependency>
  </dependencies>
</dependencyManagement>

Which, in this case, does not actually override the version of the package (despite the override claiming it would).

@michaelkedar michaelkedar added bug Something isn't working guided remediation Related to guided remediation / osv-scanner fix labels Sep 11, 2024
@cuixq cuixq changed the title pom.xml updates aren't correct for packages that use a properties in their names Fail to update Maven packages with properties in their names Sep 11, 2024
@google google deleted a comment from Apetree100122 Oct 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working guided remediation Related to guided remediation / osv-scanner fix
Projects
None yet
Development

No branches or pull requests

1 participant