fix(pom): recursive check all nested depManagements with import scope

pkg/java/pom/parse.go

@@ -407,9 +407,14 @@ func (p *parser) resolveDepManagement(props map[string]string, depManagement []p
 		if err != nil {
 			continue
 		}
+
+		// We need to recursively check all nested depManagements,
+		// so that we don't miss dependencies on nested depManagements with `Import` scope.
+		newProps := utils.MergeMaps(props, result.properties)
+		result.dependencyManagement = p.resolveDepManagement(newProps, result.dependencyManagement)
 		for k, dd := range result.dependencyManagement {
 			// Evaluate variables and overwrite dependencyManagement
-			result.dependencyManagement[k] = dd.Resolve(result.properties, nil, nil)
+			result.dependencyManagement[k] = dd.Resolve(newProps, nil, nil)
 		}
 		newDepManagement = p.mergeDependencyManagements(newDepManagement, result.dependencyManagement)
 	}

pkg/java/pom/parse_test.go

@@ -670,10 +670,9 @@ func TestPom_Parse(t *testing.T) {
 					License: "Apache 2.0",
 				},
 				{
-					ID:      "org.example:example-api:1.7.30",
+					ID:      "org.example:example-api:2.2.2",
 					Name:    "org.example:example-api",
-					Version: "1.7.30",
-					License: "The Apache Software License, Version 2.0",
+					Version: "2.2.2",
 					Locations: types.Locations{
 						{
 							StartLine: 34,
@@ -686,7 +685,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					ID: "com.example:import:2.0.0",
 					DependsOn: []string{
-						"org.example:example-api:1.7.30",
+						"org.example:example-api:2.2.2",
 					},
 				},
 			},

pkg/java/pom/testdata/import-dependency-management/pom.xml

@@ -23,7 +23,7 @@
             <dependency>
                 <groupId>org.example</groupId>
                 <artifactId>example-dependency-management</artifactId>
-                <version>2.2.2</version>
+                <version>3.3.3</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>

pkg/java/pom/testdata/repository/org/example/example-dependency-management/3.3.3/example-dependency-management-3.3.3.pom

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.example</groupId>
+    <artifactId>example-dependency-management</artifactId>
+    <version>3.3.3</version>
+
+    <packaging>pom</packaging>
+    <name>Example API Dependency Management</name>
+    <description>The example API</description>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.example</groupId>
+                <artifactId>example-dependency-management2</artifactId>
+                <version>${project.version}</version>
+                <scope>import</scope>
+                <type>pom</type>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.example</groupId>
+            <artifactId>example-dependency</artifactId>
+            <version>1.2.3</version>
+        </dependency>
+    </dependencies>
+
+</project>

pkg/java/pom/testdata/repository/org/example/example-dependency-management2/3.3.3/example-dependency-management2-3.3.3.pom

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.example</groupId>
+    <artifactId>example-dependency-management2</artifactId>
+    <version>3.3.3</version>
+
+    <packaging>pom</packaging>
+    <name>Example API Dependency Management</name>
+    <description>The example API</description>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.example</groupId>
+                <artifactId>example-dependency-management3</artifactId>
+                <version>2.2.2</version>
+                <scope>import</scope>
+                <type>pom</type>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+</project>

pkg/java/pom/testdata/repository/org/example/example-dependency-management3/2.2.2/example-dependency-management3-2.2.2.pom

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.example</groupId>
+    <artifactId>example-dependency-management3</artifactId>
+    <version>2.2.2</version>
+
+    <packaging>pom</packaging>
+    <name>Example API Dependency Management</name>
+    <description>The example API</description>
+
+    <!-- This dependencyManagement doesn't affect dependencies of example-dependency-->
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.example</groupId>
+                <artifactId>example-api</artifactId>
+                <version>${project.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+</project>

pkg/utils/utils.go

@@ -57,10 +57,12 @@ func MergeMaps(parent, child map[string]string) map[string]string {
 	if parent == nil {
 		return child
 	}
+	// Clone parent map to avoid shadow overwrite
+	newParent := maps.Clone(parent)
 	for k, v := range child {
-		parent[k] = v
+		newParent[k] = v
 	}
-	return parent
+	return newParent
 }
 
 func PackageID(name, version string) string {