transitive dependencies can't to child dependency which inherit parent's dependencies

[chenyansong1]

Description

child inherit parent's dependencies , but those dependencies could't reassign version from dependencyManager which dependency child

Desired Behavior

https://github.com/aquasecurity/trivy/blob/main/pkg/dependency/parser/java/pom/parse.go#L361

	deps := p.parseDependencies(pom.content.Dependencies.Dependency, props, depManagement, opts)
        // should reassign version which from parent' dependency, to transitive dependencies
	deps = p.mergeDependencies(parent.dependencies, deps, opts.exclusions)

Actual Behavior

could't get right dependency version

Reproduction Steps

1. trivy scan 
2. idea maven show dependencies

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

/trivy  fs -f json --list-all-pkgs ./dir/

Operating System

linux

Version

v0.54

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @chenyansong1
Thanks for your report!

mvn uses complex logic with version inheritance.
Can you share test pom.xml file with this bug?

Regards, Dmitriy

[chenyansong1]

pom.xml

4.0.0

<groupId>org.example</groupId>
<artifactId>test-dependency-mvn</artifactId>
<version>1.0-SNAPSHOT</version>

<properties>
    <maven.compiler.source>17</maven.compiler.source>
    <maven.compiler.target>17</maven.compiler.target>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <hutool.version>5.8.28</hutool.version>
</properties>


<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>cn.hutool</groupId>
            <artifactId>hutool-all</artifactId>
            <version>${hutool.version}</version>
        </dependency>
    </dependencies>
</dependencyManagement>

<dependencies>
    <dependency>
        <groupId>org.example</groupId>
        <artifactId>sub-module</artifactId>
        <version>1.0-SNAPSHOT</version>
    </dependency>
</dependencies>

dependency-parent pom.xml

4.0.0

org.example
test-maven
pom
1.0-SNAPSHOT

sub-module

test-maven

http://www.example.com

UTF-8 17 5.8.21 cn.hutool hutool-all ${hutool.version} cn.hutool hutool-all maven-clean-plugin 3.4.0

    <plugin>
      <artifactId>maven-resources-plugin</artifactId>
      <version>3.3.1</version>
    </plugin>
    <plugin>
      <artifactId>maven-compiler-plugin</artifactId>
      <version>3.13.0</version>
    </plugin>
    <plugin>
      <artifactId>maven-surefire-plugin</artifactId>
      <version>3.3.0</version>
    </plugin>
    <plugin>
      <artifactId>maven-jar-plugin</artifactId>
      <version>3.4.2</version>
    </plugin>
    <plugin>
      <artifactId>maven-install-plugin</artifactId>
      <version>3.1.2</version>
    </plugin>
    <plugin>
      <artifactId>maven-deploy-plugin</artifactId>
      <version>3.1.2</version>
    </plugin>
    <!-- site lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#site_Lifecycle -->
    <plugin>
      <artifactId>maven-site-plugin</artifactId>
      <version>3.12.1</version>
    </plugin>
    <plugin>
      <artifactId>maven-project-info-reports-plugin</artifactId>
      <version>3.6.1</version>
    </plugin>
  </plugins>
</pluginManagement>

<repository>
  <id>clife-devops-public-repository-maven-snapshots</id>
  <name>maven-snapshots</name>
  <url>https://clife-devops-maven.pkg.coding.net/repository/public-repository/maven-snapshots/</url>
  <releases>
    <enabled>false</enabled>
  </releases>
  <snapshots>
    <enabled>true</enabled>
    <updatePolicy>always</updatePolicy>
  </snapshots>
</repository>

sub-module pom.xml

test-maven
org.example
1.0-SNAPSHOT

4.0.0

<artifactId>sub-module</artifactId>

<name>sub-module</name>

<properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <maven.compiler.release>17</maven.compiler.release>
</properties>

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>cn.hutool</groupId>
            <artifactId>hutool-all</artifactId>
            <version>5.8.25</version>
        </dependency>
    </dependencies>
</dependencyManagement>

<dependencies>
</dependencies>

<build>
    <pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->
        <plugins>
            <!-- clean lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#clean_Lifecycle -->
            <plugin>
                <artifactId>maven-clean-plugin</artifactId>
                <version>3.4.0</version>
            </plugin>
            <!-- default lifecycle, jar packaging: see https://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_jar_packaging -->
            <plugin>
                <artifactId>maven-resources-plugin</artifactId>
                <version>3.3.1</version>
            </plugin>
            <plugin>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.13.0</version>
            </plugin>
            <plugin>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.3.0</version>
            </plugin>
            <plugin>
                <artifactId>maven-jar-plugin</artifactId>
                <version>3.4.2</version>
            </plugin>
            <plugin>
                <artifactId>maven-install-plugin</artifactId>
                <version>3.1.2</version>
            </plugin>
            <plugin>
                <artifactId>maven-deploy-plugin</artifactId>
                <version>3.1.2</version>
            </plugin>
            <!-- site lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#site_Lifecycle -->
            <plugin>
                <artifactId>maven-site-plugin</artifactId>
                <version>3.12.1</version>
            </plugin>
            <plugin>
                <artifactId>maven-project-info-reports-plugin</artifactId>
                <version>3.6.1</version>
            </plugin>
        </plugins>
    </pluginManagement>
</build>

[DmitriyLewen]

Hello @chenyansong1
Thanks! I was able to reproduce your case.

[DmitriyLewen]

Created #7493 for this task