dependabot-maven 0.399.0 → 0.400.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 633af390f012c6aa9704de839340e18485655cffa7ce230467f78f8b6ee2541b
-  data.tar.gz: 7062af128c881f3bfcd9aacffb61957a24700982f86d51db00bf978f8e832d51
+  metadata.gz: d916bf0c52cb0878f5ffaa396bb644c5f6529a9be503175c359395a5acb905ff
+  data.tar.gz: 0d093a3b4689ba1f54f7e6ef9f97c3a10288252a63ae2da3c122d3f30df30a1a
 SHA512:
-  metadata.gz: 5ece07a1b94981cf48b3b1638b18b1d40da3b4a19b90847641b67d226c1a60053335f1a7b2b9ed6c4007d50f733cbec8b4b19900dbde8b57aa6f15cd01ee8c37
-  data.tar.gz: f7361f3db224e9158d7f6674edeab58f05e4e2e253f366346bad32247886ced22f6dcc8f9948e0894a76cbe4cfa4b3b393ba4e1ce5b18c1bf349acf328f158a2
+  metadata.gz: a5d2b4f159ef96b9a9a5dedefd8c01e41943b97b39376d62636dc919fc3bc9d9cb693b9b29dc5528aa657dd97726f24884a13bfc96a159b0fc4afdff7fa23e8d
+  data.tar.gz: 071b060c8356276b51e441500e4318b055560b44c5a28b13d1c6e7d43154009aff748cfb56bf4fd39642c4a0888f763aab452ae23c7bb8ea5f8182137e3a5d1a

data/lib/dependabot/maven/file_parser/maven_dependency_parser.rb

@@ -3,24 +3,35 @@
 
 require "sorbet-runtime"
 
+require "dependabot/dependency"
+require "dependabot/dependency_requirement"
 require "dependabot/maven/file_parser"
 require "dependabot/maven/native_helpers"
+require "dependabot/maven/file_parser/repositories_finder"
+require "dependabot/maven/shared/maven_settings"
 
 module Dependabot
   module Maven
     class FileParser
+      # The `mvn dependency:tree` scan: runs Maven, reads its JSON output into
+      # dependencies, and merges them with the XML-declared requirements.
       class MavenDependencyParser
         extend T::Sig
 
         require "dependabot/file_parsers/base/dependency_set"
 
         DEPENDENCY_OUTPUT_FILE = "dependency-tree-output.json"
+        REGISTRY_MIRROR_ID = "dependabot-registry-mirror"
 
+        # Runs `mvn dependency:tree` and returns every resolved dependency, or nil when the
+        # scan fails so the caller can fall back to the XML-only parse.
         sig do
-          params(dependency_files: T::Array[Dependabot::DependencyFile])
-            .returns(Dependabot::FileParsers::Base::DependencySet)
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential]
+          ).returns(T.nilable(Dependabot::FileParsers::Base::DependencySet))
         end
-        def self.build_dependency_set(dependency_files)
+        def self.build_dependency_set(dependency_files, credentials: [])
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
           # Copy only pom.xml files to a temporary directory to
@@ -31,78 +42,69 @@ module Dependabot
 
             dependency_files.each do |pom|
               pom_path = File.join(project_directory, pom.name)
-              pom_dir = File.dirname(pom_path)
-              FileUtils.mkdir_p(pom_dir)
+              FileUtils.mkdir_p(File.dirname(pom_path))
               File.write(pom_path, pom.content)
             end
 
-            Dir.chdir(project_directory) do
-              NativeHelpers.run_mvn_dependency_tree_plugin(DEPENDENCY_OUTPUT_FILE)
-            end
+            Dir.chdir(project_directory) { run_scan(credentials) }
 
             # mvn CLI outputs dependency tree for each pom.xml file, collect them
             # add into single dependency set
             dependency_files.each do |pom|
-              pom_path = File.join(project_directory, pom.name)
-              pom_dir = File.dirname(pom_path)
-              output_file = File.join(pom_dir, DEPENDENCY_OUTPUT_FILE)
+              output_file = File.join(File.dirname(File.join(project_directory, pom.name)), DEPENDENCY_OUTPUT_FILE)
 
               # If we run updater from sub-module, parent file might be included in dependency files,
               # but mvn CLI will not generate dependency tree for it unless we start from the parent.
               # In that case we can just skip it and focus only on current file and it's sub-modules.
-              unless File.exist?(output_file)
-                Dependabot.logger.warn("Dependency tree output file not found: #{output_file}")
-                next
-              end
+              next unless File.exist?(output_file)
 
-              dependency_tree = JSON.parse(File.read(output_file))
-              extract_dependencies_from_tree(pom, dependency_set, dependency_tree)
+              add_tree(dependency_set, pom, JSON.parse(File.read(output_file)))
             end
           end
 
           dependency_set
+        rescue StandardError => e
+          # Never fail the job or log Maven output (it can include registry URLs) from here.
+          Dependabot.logger.warn("Maven dependency tree scan failed (#{e.class}); using declared dependencies only")
+          nil
         end
 
+        # Merges the requirements of one dependency found by both the XML parse and the scan.
+        #
+        # Each declared (XML) requirement is paired with the scanned requirement from the same
+        # POM. The XML keeps its requirement, file, groups and source, because the file updater
+        # matches them against the XML node; the scan only adds metadata Maven resolved.
+        # Scanned requirements with no declaration in that POM (inherited or transitive) are
+        # kept as they are.
         sig do
-          params(
-            pom: Dependabot::DependencyFile,
-            dependency_set: Dependabot::FileParsers::Base::DependencySet,
-            dependency_tree: T::Hash[String, Object]
-          ).void
+          params(requirements: T::Array[Dependabot::DependencyRequirement])
+            .returns(T::Array[Dependabot::DependencyRequirement])
         end
-        def self.extract_dependencies_from_tree(pom, dependency_set, dependency_tree)
-          traverse_tree = T.let(-> {}, T.proc.params(node: T::Hash[String, Object]).void)
-          traverse_tree = lambda do |node|
-            artifact_id = node["artifactId"]
-            group_id = node["groupId"]
-            version = node["version"]
-            type = node["type"]
-            classifier = node["classifier"].to_s.empty? ? nil : node["classifier"].to_s
-            scope = node["scope"]
-
-            groups = scope == "test" ? ["test"] : []
-            dependency_set << Dependabot::Dependency.new(
-              name: "#{group_id}:#{artifact_id}",
-              version: version,
-              package_manager: "maven",
-              requirements: [{
-                requirement: version,
-                file: nil,
-                groups: groups,
-                source: nil,
-                metadata: {
-                  packaging_type: type,
-                  classifier: classifier,
-                  pom_file: pom.name
-                }
-              }]
-            )
-
-            children = node["children"]
-            children.each { |child| traverse_tree.call(child) } if children.is_a?(Array)
+        def self.merge_requirements(requirements)
+          declared, scanned = requirements.partition(&:file)
+          merged = declared.map do |declared_req|
+            index = scanned.index { |req| req.metadata_string("pom_file") == declared_req.file }
+            index ? merge_requirement_pair(declared_req, T.must(scanned.delete_at(index))) : declared_req
           end
+          merged + scanned
+        end
 
-          traverse_tree.call(dependency_tree)
+        # Uses the job's registries the same way Dependabot's own Maven lookups do: a
+        # `replaces-base` registry stands in for Central, and other registries are added.
+        # Repositories declared in the POMs are left to Maven.
+        sig { params(credentials: T::Array[Dependabot::Credential]).void }
+        def self.run_scan(credentials)
+          finder = RepositoriesFinder.new(pom_fetcher: nil, credentials: credentials)
+          base_url = finder.replaces_base_url&.strip&.chomp("/")
+          mirror = base_url && Shared::MavenSettings::Mirror.new(
+            id: REGISTRY_MIRROR_ID, url: base_url, mirror_of: RepositoriesFinder::CENTRAL_REPO_ID
+          )
+
+          NativeHelpers.run_mvn_dependency_tree_plugin(
+            DEPENDENCY_OUTPUT_FILE,
+            mirror: mirror,
+            repository_urls: finder.urls_from_credentials - [base_url]
+          )
         end
 
         sig do
@@ -124,6 +126,98 @@ module Dependabot
 
           base_depth_path
         end
+
+        # The root node is the module itself and is skipped. Depth-one nodes are direct
+        # dependencies, including ones inherited from a parent POM. Deeper nodes are
+        # transitive and record the dependency that pulled them in as `pulled_in_by`.
+        sig do
+          params(
+            dependency_set: Dependabot::FileParsers::Base::DependencySet,
+            pom: Dependabot::DependencyFile,
+            tree: Object
+          ).void
+        end
+        def self.add_tree(dependency_set, pom, tree)
+          tree_children(tree).each { |node| add_tree_node(dependency_set, pom, node, pulled_in_by: nil) }
+        end
+        private_class_method :add_tree
+
+        sig do
+          params(
+            dependency_set: Dependabot::FileParsers::Base::DependencySet,
+            pom: Dependabot::DependencyFile,
+            node: T::Hash[String, Object],
+            pulled_in_by: T.nilable(String)
+          ).void
+        end
+        def self.add_tree_node(dependency_set, pom, node, pulled_in_by:)
+          group_id = node_string(node, "groupId")
+          artifact_id = node_string(node, "artifactId")
+          version = node_string(node, "version")
+          return unless group_id && artifact_id && version
+
+          name = "#{group_id}:#{artifact_id}"
+          scope = node_string(node, "scope")
+          dependency_set << Dependabot::Dependency.new(
+            name: name,
+            version: version,
+            package_manager: "maven",
+            requirements: [{
+              # Transitive dependencies keep this "declared-looking" shape on purpose:
+              # the file updater pins them through `pom_file` (see FileUpdater).
+              requirement: version,
+              file: nil,
+              groups: scope == "test" ? ["test"] : [],
+              source: nil,
+              metadata: {
+                packaging_type: node_string(node, "type"),
+                classifier: node_string(node, "classifier"),
+                scope: scope,
+                pom_file: pom.name,
+                pulled_in_by: pulled_in_by
+              }.compact
+            }]
+          )
+
+          tree_children(node).each { |child| add_tree_node(dependency_set, pom, child, pulled_in_by: name) }
+        end
+        private_class_method :add_tree_node
+
+        sig { params(node: Object).returns(T::Array[T::Hash[String, Object]]) }
+        def self.tree_children(node)
+          return [] unless node.is_a?(Hash)
+
+          value = node["children"]
+          value.is_a?(Array) ? value.grep(Hash) : []
+        end
+        private_class_method :tree_children
+
+        sig { params(node: T::Hash[String, Object], key: String).returns(T.nilable(String)) }
+        def self.node_string(node, key)
+          value = node[key]
+          value.is_a?(String) && !value.empty? ? value : nil
+        end
+        private_class_method :node_string
+
+        sig do
+          params(
+            declared: Dependabot::DependencyRequirement,
+            scanned: Dependabot::DependencyRequirement
+          ).returns(Dependabot::DependencyRequirement)
+        end
+        def self.merge_requirement_pair(declared, scanned)
+          declared_metadata = declared.metadata || {}
+          metadata = (scanned.metadata || {}).merge(declared_metadata) { |_key, scan, xml| xml.nil? ? scan : xml }
+
+          Dependabot::DependencyRequirement.create(
+            requirement: declared.requirement,
+            file: declared.file,
+            groups: declared.groups,
+            source: declared.source,
+            metadata: metadata
+          )
+        end
+        private_class_method :merge_requirement_pair
       end
     end
   end

data/lib/dependabot/maven/file_parser/repositories_finder.rb

@@ -24,6 +24,9 @@ module Dependabot
 
         REPOSITORY_SELECTOR = "repositories > repository, " \
                               "pluginRepositories > pluginRepository"
+        CREDENTIAL_TYPE = "maven_repository"
+        CENTRAL_REPO_ID = "central"
+        CENTRAL_REPO_URL = "https://repo.maven.apache.org/maven2"
         RepositoryEntry = T.type_alias { T::Hash[Symbol, T.nilable(T.any(String, T::Boolean))] }
 
         sig do
@@ -51,8 +54,22 @@ module Dependabot
 
         sig { returns(String) }
         def central_repo_url
-          base = @credentials.find { |cred| cred["type"] == "maven_repository" && cred.replaces_base? }
-          base ? T.must(base["url"]) : "https://repo.maven.apache.org/maven2"
+          replaces_base_url || CENTRAL_REPO_URL
+        end
+
+        # The URL of the credential registry that replaces Maven Central, if any.
+        sig { returns(T.nilable(String)) }
+        def replaces_base_url
+          base = @credentials.find { |cred| cred["type"] == CREDENTIAL_TYPE && cred.replaces_base? }
+          base && base["url"]
+        end
+
+        # The URLs of all `maven_repository` credentials, without trailing slashes.
+        sig { returns(T::Array[String]) }
+        def urls_from_credentials
+          @credentials
+            .select { |cred| cred["type"] == CREDENTIAL_TYPE }
+            .filter_map { |cred| cred["url"]&.strip&.gsub(%r{/$}, "") }
         end
 
         # Collect all repository URLs from this POM and its parents
@@ -90,7 +107,7 @@ module Dependabot
         # always inherited from.
         sig { returns(T::Hash[Symbol, String]) }
         def super_pom
-          { url: central_repo_url, id: "central" }
+          { url: central_repo_url, id: CENTRAL_REPO_ID }
         end
 
         sig { params(entry: Nokogiri::XML::Node).returns(T::Hash[Symbol, T.nilable(String)]) }
@@ -270,13 +287,6 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
-        sig { returns(T::Array[String]) }
-        def urls_from_credentials
-          @credentials
-            .select { |cred| cred["type"] == "maven_repository" }
-            .filter_map { |cred| cred["url"]&.strip&.gsub(%r{/$}, "") }
-        end
-
         sig { params(value: String).returns(T::Boolean) }
         def contains_property?(value)
           value.match?(property_regex)

data/lib/dependabot/maven/file_parser.rb

@@ -46,7 +46,7 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
-        if Dependabot::Experiments.enabled?(:maven_transitive_dependencies)
+        if scan_dependency_tree?
           parse_with_transitive_dependencies
         else
           parse_standard_dependencies
@@ -67,26 +67,39 @@ module Dependabot
 
       private
 
+      # Maven's own reparses (update checker, property updater) pass `skip_dependency_tree: true`:
+      # they only need declared dependencies, so they skip the expensive scan.
+      sig { returns(T::Boolean) }
+      def scan_dependency_tree?
+        return false if T.cast(options[:skip_dependency_tree], Object) == true
+
+        Dependabot::Experiments.enabled?(:maven_transitive_dependencies)
+      end
+
+      # Starts from the XML-only result and adds what `mvn dependency:tree` resolves.
+      # If the scan fails, the result is the same as with the experiment off.
       sig { returns(T::Array[Dependabot::Dependency]) }
       def parse_with_transitive_dependencies
-        dependency_set = DependencySet.new
-        dependency_set += MavenDependencyParser.build_dependency_set(pomfiles)
+        declared = parse_standard_dependencies
+        tree = MavenDependencyParser.build_dependency_set(pomfiles, credentials: credentials)
+        return declared unless tree
 
-        pomfiles.each { |pom| dependency_set += pomfile_dependencies(pom) }
-        extensionfiles.each { |extension| dependency_set += extensionfile_dependencies(extension) }
-        add_wrapper_dependencies(dependency_set)
+        dependency_set = DependencySet.new(declared)
+        tree.dependencies.each do |dep|
+          next if internal_dependency_names.include?(dep.name)
 
-        dependencies = []
-        dependency_set.dependencies.each do |dep|
-          requirements = merge_requirements(dep.requirements)
-          dependencies << Dependabot::Dependency.new(
+          tree.all_versions_for_name(dep.name).each { |version| dependency_set << version }
+        end
+
+        dependency_set.dependencies.map do |dep|
+          Dependabot::Dependency.new(
             name: dep.name,
             version: dep.version,
             package_manager: "maven",
-            requirements: requirements
+            requirements: MavenDependencyParser.merge_requirements(dep.requirements),
+            metadata: dep.metadata
           )
         end
-        dependencies
       end
 
       sig { returns(T::Array[Dependabot::Dependency]) }
@@ -527,132 +540,6 @@ module Dependabot
         raise "No pom.xml!" unless get_original_file("pom.xml")
       end
 
-      # Merge dependency scan requirements with file parsing requirements.
-      # Since dependency scan evaluates properties, we need to combine results with XML parsing,
-      # so we know when certain requirement not a literal value and can differentiate transitive dependencies
-      # from direct dependencies.
-      sig do
-        params(requirements: T::Array[Dependabot::DependencyRequirement])
-          .returns(T::Array[Dependabot::DependencyRequirement])
-      end
-      def merge_requirements(requirements)
-        return requirements if requirements.length <= 1
-
-        merged = []
-        used_indices = Set.new
-        requirements.each_with_index do |dep_scan_req, i|
-          merge_requirement_at(requirements, dep_scan_req, i, merged, used_indices)
-        end
-
-        merged
-      end
-
-      sig do
-        params(
-          requirements: T::Array[Dependabot::DependencyRequirement],
-          dep_scan_req: Dependabot::DependencyRequirement,
-          index: Integer,
-          merged: T::Array[Dependabot::DependencyRequirement],
-          used_indices: T::Set[Integer]
-        ).void
-      end
-      def merge_requirement_at(requirements, dep_scan_req, index, merged, used_indices)
-        return if used_indices.include?(index)
-
-        pom_file = dep_scan_req.metadata_string("pom_file")
-        return merged << dep_scan_req if pom_file.nil?
-
-        merge_matching_requirement(requirements, dep_scan_req, index, merged, used_indices)
-      end
-
-      sig do
-        params(
-          requirements: T::Array[Dependabot::DependencyRequirement],
-          dep_scan_req: Dependabot::DependencyRequirement,
-          index: Integer,
-          merged: T::Array[Dependabot::DependencyRequirement],
-          used_indices: T::Set[Integer]
-        ).void
-      end
-      def merge_matching_requirement(requirements, dep_scan_req, index, merged, used_indices)
-        # Look for another requirement where pom_file matches property_source
-        pom_file = T.must(dep_scan_req.metadata_string("pom_file"))
-        match_index = matching_requirement_index(requirements, pom_file, index, used_indices)
-        return merge_unmatched_requirement(dep_scan_req, index, merged, used_indices) unless match_index
-
-        parsing_req = T.must(requirements[match_index])
-        merged << merge_requirement(dep_scan_req, parsing_req)
-        used_indices.add(index)
-        used_indices.add(match_index)
-      end
-
-      sig do
-        params(
-          dep_scan_req: Dependabot::DependencyRequirement,
-          index: Integer,
-          merged: T::Array[Dependabot::DependencyRequirement],
-          used_indices: T::Set[Integer]
-        ).void
-      end
-      def merge_unmatched_requirement(dep_scan_req, index, merged, used_indices)
-        merged << dep_scan_req
-        used_indices.add(index)
-      end
-
-      sig do
-        params(
-          requirements: T::Array[Dependabot::DependencyRequirement],
-          pom_file: String,
-          index: Integer,
-          used_indices: T::Set[Integer]
-        ).returns(T.nilable(Integer))
-      end
-      def matching_requirement_index(requirements, pom_file, index, used_indices)
-        requirements.find_index.with_index do |parsing_req, i|
-          i > index && !used_indices.include?(i) && pom_file == parsing_req.file
-        end
-      end
-
-      sig do
-        params(
-          dep_scan_req: Dependabot::DependencyRequirement,
-          parsing_req: Dependabot::DependencyRequirement
-        ).returns(Dependabot::DependencyRequirement)
-      end
-      def merge_requirement(dep_scan_req, parsing_req)
-        # We prefer file and requirement properties from parsed requirements,
-        # because they include correct file and not evaluated property value.
-        merged_req = {
-          requirement: parsing_req.requirement,
-          file: parsing_req.file,
-          groups: [*dep_scan_req.groups, *parsing_req.groups].uniq.compact,
-          source: dep_scan_req.source,
-          metadata: merge_metadata(T.must(dep_scan_req.metadata), T.must(parsing_req.metadata))
-        }
-
-        Dependabot::DependencyRequirement.create(merged_req)
-      end
-
-      # Merge metadata from two requirements, combining all keys
-      sig do
-        params(
-          metadata1: Dependabot::DependencyRequirement::ObjectHash,
-          metadata2: Dependabot::DependencyRequirement::ObjectHash
-        ).returns(Dependabot::DependencyRequirement::ObjectHash)
-      end
-      def merge_metadata(metadata1, metadata2)
-        metadata1.merge(metadata2) do |_key, old_value, new_value|
-          case [old_value, new_value]
-          in [nil, new_value] then new_value
-          in [old_value, nil] then old_value
-          in [old_value, new_value] if old_value == new_value then old_value
-          else
-            # If values differ, combine them
-            [*old_value, *new_value].uniq
-          end
-        end
-      end
-
       sig { params(doc: Nokogiri::XML::Document).returns(Nokogiri::XML::NodeSet) }
       def plugin_nodes(doc)
         doc.css(PLUGIN_SELECTOR, PLUGIN_ARTIFACT_ITEMS_SELECTOR)

data/lib/dependabot/maven/native_helpers.rb

@@ -1,15 +1,12 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "fileutils"
-require "open3"
-require "tempfile"
-require "uri"
 require "sorbet-runtime"
 require "nokogiri"
 require "dependabot/errors"
 require "dependabot/command_helpers"
 require "dependabot/shared_helpers"
+require "dependabot/maven/shared/maven_settings"
 
 module Dependabot
   module Maven
@@ -49,33 +46,46 @@ module Dependabot
 
       DEPENDENCY_PLUGIN_VERSION = T.let(version, T.nilable(String))
 
+      # Inactivity timeout for the dependency tree scan. In batch mode Maven still logs each
+      # artifact download as it starts and finishes, and the tree only fetches small POMs,
+      # so this only trips when Maven is stuck (e.g. an unreachable registry).
+      DEPENDENCY_TREE_TIMEOUT = CommandHelpers::TIMEOUTS::DEFAULT
+
+      WRAPPER_MIRROR_ID = "dependabot-wrapper-mirror"
+      # Every remote repository except localhost and file-based ones.
+      WRAPPER_MIRROR_OF = "external:*"
+
+      # Runs `mvn dependency:tree` in the current directory, writing one JSON tree per module
+      # to `output_file`. Registries are set through a generated settings file.
+      # Raises `SharedHelpers::HelperSubprocessFailed` on failure or timeout.
       sig do
-        params(file_name: String).void
+        params(
+          output_file: String,
+          mirror: T.nilable(Shared::MavenSettings::Mirror),
+          repository_urls: T::Array[String]
+        ).void
       end
-      def self.run_mvn_dependency_tree_plugin(file_name)
+      def self.run_mvn_dependency_tree_plugin(output_file, mirror: nil, repository_urls: [])
         raise DependabotError, "Could not resolve maven-dependency-plugin version" unless DEPENDENCY_PLUGIN_VERSION
 
-        proxy_url = URI.parse(ENV.fetch("HTTPS_PROXY"))
-        stdout, _, status = Open3.capture3(
-          { "PROXY_HOST" => proxy_url.host },
-          "mvn",
-          "dependency:#{DEPENDENCY_PLUGIN_VERSION}:tree",
-          "-DoutputFile=#{file_name}",
-          "-DoutputType=json",
-          "-e"
-        )
-        Dependabot.logger.info("mvn dependency:tree output: STDOUT:#{stdout}")
-        handle_tool_error(stdout) unless status.success?
-      end
-
-      sig { params(output: String).void }
-      def self.handle_tool_error(output)
-        if (match = output.match(TRANSFER_FAILURE_REGEX)) &&
-           (match[:status_code] == "403" || match[:status_code] == "401")
-          raise Dependabot::PrivateSourceAuthenticationFailure, match[:repository_url]
+        # Without a proxy, the proxy block would point Maven at an unknown host.
+        proxy_env = Shared::MavenSettings.proxy_env
+        Shared::MavenSettings.with_file(
+          mirror: mirror, repository_urls: repository_urls, proxy: proxy_env.any?
+        ) do |settings_path|
+          command = [
+            "mvn",
+            "dependency:#{DEPENDENCY_PLUGIN_VERSION}:tree",
+            "-DoutputFile=#{output_file}",
+            "-DoutputType=json",
+            "-B",
+            "-s",
+            settings_path
+          ]
+          SharedHelpers.run_shell_command(
+            command, env: proxy_env, timeout: DEPENDENCY_TREE_TIMEOUT
+          )
         end
-
-        raise DependabotError, "mvn CLI failed with an unhandled error"
       end
 
       # Runs the Maven Wrapper plugin in the given directory to regenerate
@@ -133,68 +143,37 @@ module Dependabot
         # resolved version via a generated settings mirror; without it `mvn` falls back to Central
         # and hangs behind a no-egress registry. Absent when no version resolved, leaving the baked
         # Central default. The bounded timeout is explained on WRAPPER_DOWNLOAD_TIMEOUT.
-        settings_file = registry_base && wrapper_settings_file(registry_base)
-        settings_args = settings_file ? ["-s", T.must(settings_file.path)] : []
-        begin
-          output = SharedHelpers.run_shell_command(
+        run = lambda do |settings_args|
+          SharedHelpers.run_shell_command(
             cmd + settings_args,
             env: env,
             cwd: run_cwd,
             timeout: WRAPPER_DOWNLOAD_TIMEOUT
           )
-        ensure
-          settings_file&.close! # deletes the temp file
         end
+        output = if registry_base
+                   Shared::MavenSettings.with_file(mirror: wrapper_mirror(registry_base)) do |path|
+                     run.call(["-s", path])
+                   end
+                 else
+                   run.call([])
+                 end
         Dependabot.logger.info("mvn wrapper output: STDOUT:#{output}")
         output
       rescue SharedHelpers::HelperSubprocessFailed => e
         # `run_shell_command` raises HelperSubprocessFailed on a non-zero exit, and the
         # updater sanitizes that into an opaque `SubprocessFailed` that only reports the
         # command and hides the real Maven output. Log the full output and re-raise a
-        # classified Dependabot error so operators get an actionable message, mirroring
-        # the `run_mvn_dependency_tree_plugin` path.
+        # classified Dependabot error so operators get an actionable message.
         Dependabot.logger.warn("mvn wrapper command failed:\n#{e.message}")
         handle_wrapper_error(e)
       end
 
-      # Writes a temporary Maven settings file that keeps the proxy block and adds a
-      # mirror pointing every external repository at the resolved base. Registry
-      # auth still flows through the Dependabot proxy; no credentials are written here.
-      # The caller is responsible for deleting the returned file (via `close!`).
-      sig { params(registry_base: String).returns(Tempfile) }
-      def self.wrapper_settings_file(registry_base)
-        file = Tempfile.new(["dependabot-mvn-wrapper-settings", ".xml"])
-        file.write(wrapper_settings_xml(registry_base))
-        file.close
-        file
-      end
-
-      # Builds the settings XML used for the wrapper invocation: the same proxy block as
-      # the baked settings (auth is injected by the proxy) plus a `mirrorOf=external:*`
-      # mirror so plugin, transitive POM, and distribution resolution all route through
-      # the resolved base instead of Central.
-      sig { params(registry_base: String).returns(String) }
-      def self.wrapper_settings_xml(registry_base)
-        <<~XML
-          <settings>
-            <proxies>
-              <proxy>
-                <id>dependabot-proxy</id>
-                <active>true</active>
-                <protocol>http</protocol>
-                <host>${env.PROXY_HOST}</host>
-                <port>1080</port>
-              </proxy>
-            </proxies>
-            <mirrors>
-              <mirror>
-                <id>dependabot-wrapper-mirror</id>
-                <mirrorOf>external:*</mirrorOf>
-                <url>#{registry_base.encode(xml: :text)}</url>
-              </mirror>
-            </mirrors>
-          </settings>
-        XML
+      # The wrapper has no repositories of its own, so every external repository (plugin,
+      # transitive POMs and the distribution) is routed to the registry that served the version.
+      sig { params(registry_base: String).returns(Shared::MavenSettings::Mirror) }
+      def self.wrapper_mirror(registry_base)
+        Shared::MavenSettings::Mirror.new(id: WRAPPER_MIRROR_ID, url: registry_base, mirror_of: WRAPPER_MIRROR_OF)
       end
 
       # Classifies a failed Maven Wrapper invocation into an actionable Dependabot

data/lib/dependabot/maven/shared/maven_settings.rb

@@ -0,0 +1,111 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "tempfile"
+require "uri"
+require "sorbet-runtime"
+
+module Dependabot
+  module Maven
+    module Shared
+      # Builds the temporary Maven `settings.xml` files passed to native `mvn` runs with `-s`.
+      # They keep the proxy block from the baked `~/.m2/settings.xml` (the Dependabot proxy
+      # injects registry auth, so no credentials are written here) and can add a mirror and
+      # extra repositories.
+      module MavenSettings
+        extend T::Sig
+
+        PROXIES_XML = <<~XML
+          <proxies>
+            <proxy>
+              <id>dependabot-proxy</id>
+              <active>true</active>
+              <protocol>http</protocol>
+              <host>${env.PROXY_HOST}</host>
+              <port>1080</port>
+            </proxy>
+          </proxies>
+        XML
+
+        # A settings `<mirror>` that routes matching repositories to one registry.
+        class Mirror < T::ImmutableStruct
+          const :id, String
+          const :url, String
+          const :mirror_of, String
+        end
+
+        # Writes a settings file, yields its path, and deletes it afterwards.
+        sig do
+          type_parameters(:R)
+            .params(
+              mirror: T.nilable(Mirror),
+              repository_urls: T::Array[String],
+              proxy: T::Boolean,
+              blk: T.proc.params(path: String).returns(T.type_parameter(:R))
+            )
+            .returns(T.type_parameter(:R))
+        end
+        def self.with_file(mirror: nil, repository_urls: [], proxy: true, &blk)
+          file = Tempfile.new(["dependabot-mvn-settings", ".xml"])
+          file.write(xml(mirror: mirror, repository_urls: repository_urls, proxy: proxy))
+          file.close
+          yield T.must(file.path)
+        ensure
+          file&.close!
+        end
+
+        sig do
+          params(mirror: T.nilable(Mirror), repository_urls: T::Array[String], proxy: T::Boolean).returns(String)
+        end
+        def self.xml(mirror: nil, repository_urls: [], proxy: true)
+          sections = proxy ? [PROXIES_XML] : []
+          sections << mirrors_xml(mirror) if mirror
+          sections << repositories_xml(repository_urls) if repository_urls.any?
+          "<settings>\n#{sections.join.gsub(/^(?=.)/, '  ')}</settings>\n"
+        end
+
+        # The environment the proxy block reads its host from.
+        sig { returns(T::Hash[String, String]) }
+        def self.proxy_env
+          proxy = ENV.fetch("HTTPS_PROXY", nil)
+          proxy ? { "PROXY_HOST" => URI.parse(proxy).host.to_s } : {}
+        end
+
+        sig { params(mirror: Mirror).returns(String) }
+        def self.mirrors_xml(mirror)
+          <<~XML
+            <mirrors>
+              <mirror>
+                <id>#{mirror.id.encode(xml: :text)}</id>
+                <mirrorOf>#{mirror.mirror_of.encode(xml: :text)}</mirrorOf>
+                <url>#{mirror.url.encode(xml: :text)}</url>
+              </mirror>
+            </mirrors>
+          XML
+        end
+        private_class_method :mirrors_xml
+
+        # Adds each URL as both a repository and a plugin repository, in an always-active profile.
+        sig { params(urls: T::Array[String]).returns(String) }
+        def self.repositories_xml(urls)
+          entries = urls.each_with_index.map do |url, index|
+            "<id>dependabot-registry-#{index + 1}</id><url>#{url.encode(xml: :text)}</url>"
+          end
+          <<~XML
+            <profiles>
+              <profile>
+                <id>dependabot-registries</id>
+                <repositories>#{entries.map { |e| "<repository>#{e}</repository>" }.join}</repositories>
+                <pluginRepositories>#{entries.map { |e| "<pluginRepository>#{e}</pluginRepository>" }.join}</pluginRepositories>
+              </profile>
+            </profiles>
+            <activeProfiles>
+              <activeProfile>dependabot-registries</activeProfile>
+            </activeProfiles>
+          XML
+        end
+        private_class_method :repositories_xml
+      end
+    end
+  end
+end

data/lib/dependabot/maven/update_checker/property_updater.rb

@@ -59,6 +59,7 @@ module Dependabot
               next false if version_string(dep).nil?
 
               next false if includes_property_reference?(updated_version(dep))
+              next false unless writable_requirements?(dep)
 
               releases = VersionFinder.new(
                 dependency: dep,
@@ -124,13 +125,10 @@ module Dependabot
           @dependencies_using_property ||= T.let(
             Maven::FileParser.new(
               dependency_files: dependency_files,
-              source: nil
+              source: nil,
+              options: { skip_dependency_tree: true }
             ).parse.select do |dep|
-              dep.requirements.any? do |r|
-                next unless r.metadata_string("property_name") == property_name
-
-                r.metadata_string("property_source") == property_source
-              end
+              dep.requirements.any? { |requirement| uses_property?(requirement) }
             end,
             T.nilable(T::Array[Dependabot::Dependency])
           )
@@ -233,12 +231,7 @@ module Dependabot
 
         sig { params(dep: Dependabot::Dependency).returns(Dependabot::DependencyRequirement) }
         def declaring_property_requirement(dep)
-          declaring_requirement =
-            dep.requirements.find do |r|
-              next false unless r.metadata_string("property_name") == property_name
-
-              r.metadata_string("property_source") == property_source
-            end
+          declaring_requirement = dep.requirements.find { |requirement| uses_property?(requirement) }
 
           return declaring_requirement if declaring_requirement
 
@@ -246,6 +239,12 @@ module Dependabot
                 "Requirement not found for property #{property_name} from #{property_source || 'unknown source'}"
         end
 
+        sig { params(requirement: Dependabot::DependencyRequirement).returns(T::Boolean) }
+        def uses_property?(requirement)
+          requirement.metadata_string("property_name") == property_name &&
+            requirement.metadata_string("property_source") == property_source
+        end
+
         sig { params(dep: Dependabot::Dependency).returns(T::Array[Dependabot::DependencyRequirement]) }
         def updated_requirements(dep)
           @updated_requirements ||= T.let({}, T.nilable(T::Hash[String, T::Array[Dependabot::DependencyRequirement]]))
@@ -255,7 +254,25 @@ module Dependabot
               latest_version: updated_version(dep),
               source_url: source_url,
               properties_to_update: [property_name]
-            ).updated_requirements
+            ).updated_requirements.map.with_index do |requirement, index|
+              next requirement unless requirement.metadata_string("property_name")
+
+              uses_property?(requirement) ? requirement : dep.requirements.fetch(index)
+            end
+        end
+
+        sig { params(dep: Dependabot::Dependency).returns(T::Boolean) }
+        def writable_requirements?(dep)
+          updated = updated_requirements(dep)
+          writable = dep.requirements.each_with_index.any? do |requirement, index|
+            uses_property?(requirement) && updated.fetch(index).requirement != requirement.requirement
+          end
+          return true if writable
+
+          Dependabot.logger.info(
+            "Cannot update shared property #{property_name}: no writable requirement changes for #{dep.name}"
+          )
+          false
         end
 
         sig { returns(Dependabot::Maven::FileParser::PropertyValueFinder) }

data/lib/dependabot/maven/update_checker.rb

@@ -70,12 +70,14 @@ module Dependabot
         # Maven's version resolution algorithm is very simple: it just uses
         # the version defined "closest", with the first declaration winning
         # if two declarations are equally close. As a result, we can just
-        # return that latest version unless dealing with a property dep.
+        # return the latest version with writable requirements unless dealing
+        # with a property dep.
         # https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Transitive_Dependencies
         return nil if version_comes_from_multi_dependency_property?
-        return nil if version_comes_from_project_parent_version?
+        return nil if version_comes_from_parent_version?
 
-        latest_version
+        version = latest_version
+        version if writable_requirements?(version)
       end
 
       sig { override.returns(T.nilable(Dependabot::Version)) }
@@ -88,7 +90,10 @@ module Dependabot
 
       sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_resolvable_security_fix_version
-        lowest_security_fix_version
+        return nil if version_comes_from_parent_version?
+
+        version = lowest_security_fix_version
+        version if writable_requirements?(version)
       end
 
       sig { override.returns(T.nilable(Dependabot::Version)) }
@@ -105,16 +110,7 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        property_names =
-          declarations_using_a_property
-          .filter_map { |req| req.metadata_string("property_name") }
-
-        RequirementsUpdater.new(
-          requirements: dependency.requirements,
-          latest_version: preferred_resolvable_version&.to_s,
-          source_url: preferred_version_details&.fetch(:source_url),
-          properties_to_update: property_names
-        ).updated_requirements
+        updated_requirements_for(preferred_resolvable_version)
       end
 
       sig { override.returns(T::Boolean) }
@@ -136,9 +132,40 @@ module Dependabot
 
       private
 
+      sig { params(version: T.nilable(Dependabot::Version)).returns(T::Boolean) }
+      def writable_requirements?(version)
+        return false unless version
+        return false unless requirements_unlocked_or_can_be?
+
+        updated = updated_requirements_for(version)
+        return true if updated.map(&:requirement) != dependency.requirements.map(&:requirement)
+
+        Dependabot.logger.info(
+          "Cannot update #{dependency.name} to #{version}: no writable requirement changes " \
+          "(requirements may be inherited or ranges)"
+        )
+        false
+      end
+
+      sig do
+        params(version: T.nilable(T.any(String, Gem::Version))).returns(T::Array[Dependabot::DependencyRequirement])
+      end
+      def updated_requirements_for(version)
+        property_names =
+          declarations_using_a_property
+          .filter_map { |req| req.metadata_string("property_name") }
+
+        RequirementsUpdater.new(
+          requirements: dependency.requirements,
+          latest_version: version&.to_s,
+          source_url: preferred_version_details&.fetch(:source_url),
+          properties_to_update: property_names
+        ).updated_requirements
+      end
+
       sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
-        return false if version_comes_from_project_parent_version?
+        return false if version_comes_from_parent_version?
         return false unless version_comes_from_multi_dependency_property?
 
         property_updater.update_possible?
@@ -244,16 +271,17 @@ module Dependabot
         @all_property_based_dependencies ||=
           Maven::FileParser.new(
             dependency_files: dependency_files,
-            source: nil
+            source: nil,
+            options: { skip_dependency_tree: true }
           ).parse.select do |dep|
             dep.requirements.any? { |req| req.metadata_string("property_name") }
           end
       end
 
       sig { returns(T::Boolean) }
-      def version_comes_from_project_parent_version?
+      def version_comes_from_parent_version?
         declarations_using_a_property.any? do |requirement|
-          requirement.metadata_string("property_name") == "project.parent.version"
+          requirement.metadata_string("property_name")&.sub(/\A(?:pom|project)\./, "") == "parent.version"
         end
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.399.0
+  version: 0.400.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.399.0
+        version: 0.400.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.399.0
+        version: 0.400.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -278,6 +278,7 @@ files:
 - lib/dependabot/maven/pom.xml
 - lib/dependabot/maven/requirement.rb
 - lib/dependabot/maven/shared/base_version_finder.rb
+- lib/dependabot/maven/shared/maven_settings.rb
 - lib/dependabot/maven/shared/property_value_finding.rb
 - lib/dependabot/maven/shared/shared_metadata_finder.rb
 - lib/dependabot/maven/shared/shared_package_details_fetcher.rb
@@ -297,7 +298,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
 rdoc_options: []
 require_paths:
 - lib