fix: resolve overridden plugin dependencies correctly (#8570) by bjansen · Pull Request #8567 · dependency-check/DependencyCheck

bjansen · 2026-06-03T19:16:23Z

Description of Change

When a pom.xml overrides a plugin's dependencies like this, dependency-check does not take the overrides into account, which might lead to false positives:

<build>
	<pluginManagement>
		<plugin>
			<groupId>org.apache.maven.plugins</groupId>
			<artifactId>maven-clean-plugin</artifactId>
			<version>3.5.0</version>
			<dependencies>
				<dependency>
					<groupId>org.codehaus.plexus</groupId>
					<artifactId>plexus-utils</artifactId>
					<version>4.0.3</version>
				</dependency>
			</dependencies>
		</plugin>
	</pluginManagement>
</build>

In this particular case, dependency-check reports the following error:

[ERROR] plexus-utils-3.0.24.jar (pkg:maven/org.codehaus.plexus/plexus-utils@3.0.24, cpe:2.3:a:codehaus-plexus:plexus-utils:3.0.24:::::::, cpe:2.3:a:utils_project:utils:3.0.24:::::::): CVE-2025-67030(8.8)

The idea in this PR is to mimic what's done in mvn dependency:resolve-plugins, that is to say to enhance the CollectRequest with a list of plugin dependencies declared in the pom.xml being scanned:

a list of plugin dependencies is created here
and then passed to the CollectRequest here

Related issues

This should fix #8570

Have test cases been added to cover the new functionality?

Not yet, I'm just making sure I'm heading towards the right fix for now.

Copilot

Pull request overview

This PR updates the Maven plugin’s plugin-dependency scanning to account for dependency overrides declared on plugins in the project POM (so overridden plugin dependency versions are resolved correctly and don’t produce false positives).

Changes:

Look up the matching Plugin in the MavenProject when resolving a plugin artifact’s transitive dependencies.
Add the plugin’s declared dependencies to the Aether CollectRequest so they participate in dependency mediation during resolution.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

    protected Set<Artifact> resolveArtifactDependencies(final org.eclipse.aether.artifact.Artifact rootArtifact, MavenProject project)
            throws DependencyResolutionException {
        final CollectRequest collectRequest = new CollectRequest();
        collectRequest.setRoot(new org.eclipse.aether.graph.Dependency(rootArtifact, null));
        collectRequest.setRepositories(project.getRemoteProjectRepositories());


bjansen · 2026-06-04T07:42:33Z

@jeremylong before I polish this PR, do you think this approach looks sensible and is worth working on?

chadlwilson · 2026-06-04T08:37:15Z

Without a test to demonstrate what is wrong about the previous behaviour and how this change actually alters that behaviour, it's a bit difficult to understand why this works or whether it actually works. Also - any reason for merging into the upgradeMaven branch? That branch is stale, I believe.

I also am finding it difficult to correlate the change to the discussions in #7566 - the root of the issue seems to be that it is including irrelevant provided dependencies which are always unwanted, because they are not consumed at runtime. Seems we should be tackling the root cause directly?

bjansen · 2026-06-04T09:02:38Z

any reason for merging into the upgradeMaven branch? That branch is stale, I believe.

From what I can see, the branch was updated 2 days ago and main does not contain changes related to the use of Maven Resolver.

Without a test to demonstrate what is wrong about the previous behaviour and how this change actually alters that behaviour, it's a bit difficult to understand why this works or whether it actually works

Fair point, I ran the plugin on my machine and it fixed my problem but you have no way to verify that :). I just wanted a quick feedback from you guys before taking more time to work on tests etc. I don't want to waste your time nor mine if this PR is silly and won't be accepted. Consider it a draft for now.

I'm not entirely sure it's the same root cause as #7566, in my case dependency-check is reporting FPs on plugins, not on provided dependencies, so I'll probably open a new ticket for my specific problem.

bjansen · 2026-06-04T09:38:54Z

FYI I created a separate issue for my problem: #8570

…ck#8570)

chadlwilson · 2026-06-04T09:47:05Z

Ahh, my bad, I hadn’t realized #8560 was only merged into a branch, as that’s unusual for the project. That would also explain why using SNAPSHOTs would make no difference for you 😓

bjansen · 2026-06-04T09:54:06Z

I checked out the upgradeMaven branch to test version 13.0.0-SNAPSHOT, and it did not fix my problem. That's why I proposed this PR and used upgradeMaven as a baseline.

How do tests work in the dependency-check-maven module? I see a bunch of poms in maven/src/it but I have no clue how they are run and how to make assertions on the build result to validate my fix.

chadlwilson · 2026-06-04T10:06:00Z

Canonical published snapshots only come from main, not arbitrary branches, hence the confusion when you say you tested with a snapshot.

There are some kind of unit tests there (possibly limited, haven’t paid much attention to the maven plugin), but the integration tests can be run with -PFullIntegrationTesting similar to the build. They invoke maven in an isolated process.

DependencyCheck/.github/workflows/build-pull-requests.yml

Lines 144 to 146 in 6ab9d08

    
                   run: > 
        
                     mvn -V -s settings.xml -pl maven -am  
        
                     clean verify -DskipTests=true -PFullIntegrationTesting

If your fix is not dependent on using the maven resolver it would be better to not be building on top of WIP from a separate experimental draft branch though. I imagine there’s no guarantee that branch will be merged, or when?

boring-cyborg Bot added the maven changes to the maven plugin label Jun 3, 2026

bjansen mentioned this pull request Jun 3, 2026

Pulling in old vulnerable version of maven-core #7566

Open

1 task

bjansen changed the title ~~Resolve overridden plugin dependencies correctly (#7566)~~ fix: resolve overridden plugin dependencies correctly (#7566) Jun 3, 2026

bjansen force-pushed the bugfix/gh-7566-plugin-deps branch from f077517 to ba3833c Compare June 3, 2026 19:20

jeremylong requested a review from Copilot June 4, 2026 00:46

Copilot started reviewing on behalf of jeremylong June 4, 2026 00:46 View session

Copilot AI reviewed Jun 4, 2026

View reviewed changes

bjansen force-pushed the bugfix/gh-7566-plugin-deps branch from ba3833c to 1a616ff Compare June 4, 2026 07:50

fix: resolve overridden plugin dependencies correctly (dependency-che…

f476b6d

…ck#8570)

bjansen force-pushed the bugfix/gh-7566-plugin-deps branch from 1a616ff to f476b6d Compare June 4, 2026 09:40

bjansen changed the title ~~fix: resolve overridden plugin dependencies correctly (#7566)~~ fix: resolve overridden plugin dependencies correctly (#8570) Jun 4, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: resolve overridden plugin dependencies correctly (#8570)#8567

fix: resolve overridden plugin dependencies correctly (#8570)#8567
bjansen wants to merge 1 commit into
dependency-check:upgradeMavenfrom
bjansen:bugfix/gh-7566-plugin-deps

bjansen commented Jun 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bjansen commented Jun 4, 2026

Uh oh!

chadlwilson commented Jun 4, 2026

Uh oh!

bjansen commented Jun 4, 2026 •

edited

Loading

Uh oh!

bjansen commented Jun 4, 2026

Uh oh!

chadlwilson commented Jun 4, 2026

Uh oh!

bjansen commented Jun 4, 2026

Uh oh!

chadlwilson commented Jun 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bjansen commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of Change

Related issues

Have test cases been added to cover the new functionality?

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bjansen commented Jun 4, 2026

Uh oh!

chadlwilson commented Jun 4, 2026

Uh oh!

bjansen commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bjansen commented Jun 4, 2026

Uh oh!

chadlwilson commented Jun 4, 2026

Uh oh!

bjansen commented Jun 4, 2026

Uh oh!

chadlwilson commented Jun 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bjansen commented Jun 3, 2026 •

edited

Loading

bjansen commented Jun 4, 2026 •

edited

Loading