dependabot-maven 0.403.0 → 0.404.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8a4a325eae6ecf3fa9008b9f0608d03af0518c985b7faf3da5d04a18da2b150d
-  data.tar.gz: 0d093a3b4689ba1f54f7e6ef9f97c3a10288252a63ae2da3c122d3f30df30a1a
+  metadata.gz: 882f62fae9fb3288a00474757b26ab2d3d69c4564b5c57fb1934f95e4064a901
+  data.tar.gz: cf2b50d9b0fcf12cb1215a37fbf51244a497c2225f57a0508e772004d8e3648b
 SHA512:
-  metadata.gz: 34fd68f921798a220313e119d08342578ee01329aad9f927e31aa6f3940b242f79381d28d610a3c4721d87939ef21a91f305312e21c22a2fb095d45af27dc96e
-  data.tar.gz: 071b060c8356276b51e441500e4318b055560b44c5a28b13d1c6e7d43154009aff748cfb56bf4fd39642c4a0888f763aab452ae23c7bb8ea5f8182137e3a5d1a
+  metadata.gz: 0ecba86abf4fa974cdc7a096fac2b0df7385f90456502d283f92616f4ecd82f883a93896220f0da2b3df42033ef95b7a0014c972f834485e2444b1d79993f307
+  data.tar.gz: 84fd19d904f5785f35a9f676fb9aa9d46cabe7d1480828d510153be50786669db50af500ddfc5c8895996735d6008394839f803d590e6c22331d7d702c780fb5

data/lib/dependabot/maven/file_parser/maven_dependency_parser.rb

@@ -199,6 +199,8 @@ module Dependabot
         end
         private_class_method :node_string
 
+        # The classifier names which XML entry this is (unclassified means the plain artifact), so
+        # it's never taken from the scan, which matches artifacts by name only.
         sig do
           params(
             declared: Dependabot::DependencyRequirement,
@@ -207,7 +209,8 @@ module Dependabot
         end
         def self.merge_requirement_pair(declared, scanned)
           declared_metadata = declared.metadata || {}
-          metadata = (scanned.metadata || {}).merge(declared_metadata) { |_key, scan, xml| xml.nil? ? scan : xml }
+          scanned_metadata = (scanned.metadata || {}).except(:classifier, "classifier")
+          metadata = scanned_metadata.merge(declared_metadata) { |_key, scan, xml| xml.nil? ? scan : xml }
 
           Dependabot::DependencyRequirement.create(
             requirement: declared.requirement,

data/lib/dependabot/maven/file_parser/transitive_override_finder.rb

@@ -0,0 +1,208 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "nokogiri"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/maven/file_parser"
+
+module Dependabot
+  module Maven
+    class FileParser
+      # Decides whether a `<dependencyManagement>` entry overrides a transitive version.
+      #
+      # An entry is an override when no POM in its local lineage (itself, its local
+      # parents and its local children) declares the artifact in a `<dependencies>`
+      # section. Parents count because their dependencies are inherited; sibling
+      # modules don't, as the entry doesn't manage their declarations. A local BOM,
+      # and every local POM inheriting from it, also manages the lineage of each
+      # local POM that imports it.
+      class TransitiveOverrideFinder
+        extend T::Sig
+
+        sig do
+          params(
+            pomfiles: T::Array[Dependabot::DependencyFile],
+            declared_keys_by_pom: T::Hash[String, T::Set[String]],
+            property_value_finder: PropertyValueFinder
+          ).void
+        end
+        def initialize(pomfiles:, declared_keys_by_pom:, property_value_finder:)
+          @pomfiles = pomfiles
+          @declared_keys_by_pom = declared_keys_by_pom
+          @property_value_finder = property_value_finder
+          @lineages = T.let({}, T::Hash[String, T::Array[String]])
+          @documents = T.let({}, T::Hash[String, Nokogiri::XML::Document])
+        end
+
+        # `key` is the entry's groupId:artifactId:type:classifier management key.
+        sig { params(pom: Dependabot::DependencyFile, key: String).returns(T::Boolean) }
+        def override?(pom:, key:)
+          lineage(pom.name).none? { |pom_name| @declared_keys_by_pom.fetch(pom_name, Set.new).include?(key) }
+        end
+
+        private
+
+        sig { params(pom_name: String).returns(T::Array[String]) }
+        def lineage(pom_name)
+          @lineages[pom_name] ||= begin
+            found = T.let([], T::Array[String])
+            visited = T.let([], T::Array[String])
+            queue = [pom_name]
+            while (current = queue.shift)
+              next if visited.include?(current)
+
+              visited << current
+              found.concat(inheritance_line(current)).uniq!
+              # Importing a BOM also imports what it inherits, so importers of its children count too.
+              ([current] + descendants(current)).each do |bom|
+                queue.concat(local_importer_names.fetch(bom, []))
+              end
+            end
+            found
+          end
+        end
+
+        sig { params(pom_name: String).returns(T::Array[String]) }
+        def inheritance_line(pom_name)
+          ancestors(pom_name) + [pom_name] + descendants(pom_name)
+        end
+
+        # Maps each local BOM file name to the file names of the local POMs that import it.
+        sig { returns(T::Hash[String, T::Array[String]]) }
+        def local_importer_names
+          @local_importer_names ||= T.let(
+            @pomfiles.each_with_object({}) do |pom, importers|
+              imported_coordinates(pom).each do |coordinates|
+                bom = coordinates_to_pom_name[coordinates]
+                next if bom.nil? || bom == pom.name
+
+                (importers[bom] ||= []) << pom.name
+              end
+            end,
+            T.nilable(T::Hash[String, T::Array[String]])
+          )
+        end
+
+        sig { params(pom: Dependabot::DependencyFile).returns(T::Array[String]) }
+        def imported_coordinates(pom)
+          document(pom).xpath("//dependencyManagement/dependencies/dependency").filter_map do |node|
+            import_coordinates(node, pom)
+          end
+        end
+
+        sig { params(node: Nokogiri::XML::Element, pom: Dependabot::DependencyFile).returns(T.nilable(String)) }
+        def import_coordinates(node, pom)
+          return unless child_value(node, "scope", pom) == "import"
+
+          group_id = child_value(node, "groupId", pom)
+          artifact_id = child_value(node, "artifactId", pom)
+          return unless group_id && artifact_id
+
+          "#{group_id}:#{artifact_id}"
+        end
+
+        sig do
+          params(node: Nokogiri::XML::Element, name: String, pom: Dependabot::DependencyFile).returns(T.nilable(String))
+        end
+        def child_value(node, name, pom)
+          resolved_text(node.at_xpath("./#{name}"), pom)
+        end
+
+        sig { params(node: T.nilable(Nokogiri::XML::Node), pom: Dependabot::DependencyFile).returns(T.nilable(String)) }
+        def resolved_text(node, pom)
+          value = T.let(node&.content&.strip, T.nilable(String))
+          return value unless value&.match?(PROPERTY_REGEX)
+
+          value.gsub(PROPERTY_REGEX) do |placeholder|
+            resolved_property(T.must(Regexp.last_match)[:property].to_s, pom) || placeholder
+          end
+        end
+
+        sig { params(property_name: String, pom: Dependabot::DependencyFile).returns(T.nilable(String)) }
+        def resolved_property(property_name, pom)
+          details = @property_value_finder.property_details(property_name: property_name, callsite_pom: pom)
+          value = details&.fetch(:value)
+          value.is_a?(String) ? value : nil
+        rescue Dependabot::DependabotError
+          nil
+        end
+
+        sig { params(pom_name: String).returns(T::Array[String]) }
+        def ancestors(pom_name)
+          found = T.let([], T::Array[String])
+          current = T.let(local_parent_names[pom_name], T.nilable(String))
+          while current && !found.include?(current) && current != pom_name
+            found << current
+            current = local_parent_names[current]
+          end
+          found
+        end
+
+        sig { params(pom_name: String).returns(T::Array[String]) }
+        def descendants(pom_name)
+          found = T.let([], T::Array[String])
+          queue = [pom_name]
+          while (current = queue.shift)
+            local_parent_names.each do |child, parent|
+              next unless parent == current
+              next if child == pom_name || found.include?(child)
+
+              found << child
+              queue << child
+            end
+          end
+          found
+        end
+
+        # Maps each POM file name to the file name of its parent, when the parent is in the job.
+        sig { returns(T::Hash[String, String]) }
+        def local_parent_names
+          @local_parent_names ||= T.let(
+            @pomfiles.each_with_object({}) do |pom, parents|
+              coordinates = parent_coordinates(pom)
+              parent = coordinates && coordinates_to_pom_name[coordinates]
+              parents[pom.name] = parent if parent && parent != pom.name
+            end,
+            T.nilable(T::Hash[String, String])
+          )
+        end
+
+        sig { returns(T::Hash[String, String]) }
+        def coordinates_to_pom_name
+          @coordinates_to_pom_name ||= T.let(
+            @pomfiles.each_with_object({}) do |pom, map|
+              doc = document(pom)
+              group_id = resolved_text(doc.at_xpath("/project/groupId") || doc.at_xpath("/project/parent/groupId"), pom)
+              artifact_id = resolved_text(doc.at_xpath("/project/artifactId"), pom)
+              next unless group_id && artifact_id
+
+              map["#{group_id}:#{artifact_id}"] ||= pom.name
+            end,
+            T.nilable(T::Hash[String, String])
+          )
+        end
+
+        sig { params(pom: Dependabot::DependencyFile).returns(T.nilable(String)) }
+        def parent_coordinates(pom)
+          doc = document(pom)
+          group_id = doc.at_xpath("/project/parent/groupId")
+          artifact_id = doc.at_xpath("/project/parent/artifactId")
+          return unless group_id && artifact_id
+
+          "#{group_id.content.strip}:#{artifact_id.content.strip}"
+        end
+
+        sig { params(pom: Dependabot::DependencyFile).returns(Nokogiri::XML::Document) }
+        def document(pom)
+          @documents[pom.name] ||= begin
+            doc = Nokogiri::XML(pom.content)
+            doc.remove_namespaces!
+            doc
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/maven/file_parser.rb

@@ -24,6 +24,7 @@ module Dependabot
       require "dependabot/file_parsers/base/dependency_set"
       require_relative "file_parser/maven_dependency_parser"
       require_relative "file_parser/property_value_finder"
+      require_relative "file_parser/transitive_override_finder"
       require_relative "file_parser/wrapper_mojo"
 
       # The following "dependencies" are candidates for updating:
@@ -36,10 +37,18 @@ module Dependabot
                             "extensions > extension, " \
                             "annotationProcessorPaths > path"
       PLUGIN_SELECTOR     = "plugins > plugin"
-      EXTENSION_SELECTOR  = "extensions > extension"
+      # `<dependencies>` under these elements don't declare a project dependency.
+      NON_DECLARING_SECTIONS = %w(dependencyManagement plugin).freeze
+      EXTENSION_SELECTOR = "extensions > extension"
       TARGET_SELECTOR = "target > locations > location[type='Maven'] > dependencies > dependency"
       PLUGIN_ARTIFACT_ITEMS_SELECTOR = "plugins > plugin > executions > execution > " \
                                        "configuration > artifactItems > artifactItem"
+      # Annotation processor paths and plugin artifact items can take their version
+      # from `<dependencyManagement>`, so they count as declarations too.
+      DECLARATION_SELECTOR = T.let(
+        "dependencies > dependency, annotationProcessorPaths > path, #{PLUGIN_ARTIFACT_ITEMS_SELECTOR}".freeze,
+        String
+      )
 
       # Regex to get the property name from a declaration that uses a property
       PROPERTY_REGEX = /\$\{(?<property>.*?)\}/
@@ -285,12 +294,85 @@ module Dependabot
             source: nil,
             metadata: {
               packaging_type: packaging_type(pom, dependency_node),
-              classifier: dependency_classifier(dependency_node, pom)
+              classifier: dependency_classifier(dependency_node, pom),
+              transitive_override: transitive_override?(pom, dependency_node, is_plugin: is_plugin) || nil
             }.merge(property_details).compact
           }]
         )
       end
 
+      # A `<dependencyManagement>` entry (not a BOM import) for an artifact that nothing in its
+      # POM lineage declares only sets a transitive version. Tagged with the experiment on, so
+      # the update checker can leave it alone outside security updates.
+      sig do
+        params(
+          pom: Dependabot::DependencyFile,
+          dependency_node: Nokogiri::XML::Element,
+          is_plugin: T::Boolean
+        ).returns(T::Boolean)
+      end
+      def transitive_override?(pom, dependency_node, is_plugin:)
+        return false if is_plugin
+        return false unless Dependabot::Experiments.enabled?(:maven_transitive_dependencies)
+        return false unless dependency_management_node?(dependency_node)
+        return false if dependency_scope(pom, dependency_node) == "import"
+
+        key = management_key(dependency_node, pom)
+        !key.nil? && transitive_override_finder.override?(pom: pom, key: key)
+      end
+
+      sig { params(node: Nokogiri::XML::Node).returns(T::Boolean) }
+      def dependency_management_node?(node)
+        node.name == "dependency" && node.ancestors.any? { |a| a.name == "dependencyManagement" }
+      end
+
+      sig { returns(TransitiveOverrideFinder) }
+      def transitive_override_finder
+        @transitive_override_finder ||= T.let(
+          TransitiveOverrideFinder.new(
+            pomfiles: pomfiles,
+            declared_keys_by_pom: declared_keys_by_pom,
+            property_value_finder: property_value_finder
+          ),
+          T.nilable(TransitiveOverrideFinder)
+        )
+      end
+
+      # Management keys of the artifacts each POM declares in a `<dependencies>`
+      # section, as an annotation processor path or as a plugin artifact item,
+      # excluding `<dependencyManagement>` entries and plugin dependencies.
+      sig { returns(T::Hash[String, T::Set[String]]) }
+      def declared_keys_by_pom
+        pomfiles.to_h do |pom|
+          doc = Nokogiri::XML(pom.content)
+          doc.remove_namespaces!
+          keys = doc.css(DECLARATION_SELECTOR).each_with_object(Set.new) do |node, set|
+            next if node.name == "dependency" && node.ancestors.any? { |a| NON_DECLARING_SECTIONS.include?(a.name) }
+
+            key = declared_key(node, pom)
+            set << key if key
+          end
+          [pom.name, keys]
+        end
+      end
+
+      sig { params(node: Nokogiri::XML::Element, pom: Dependabot::DependencyFile).returns(T.nilable(String)) }
+      def declared_key(node, pom)
+        management_key(node, pom)
+      rescue DependencyFileNotEvaluatable
+        nil
+      end
+
+      # Maven matches a declaration to a `<dependencyManagement>` entry by groupId, artifactId,
+      # type and classifier, so a `test-jar` or classified declaration doesn't use the plain jar entry.
+      sig { params(node: Nokogiri::XML::Element, pom: Dependabot::DependencyFile).returns(T.nilable(String)) }
+      def management_key(node, pom)
+        name = dependency_name(node, pom)
+        return unless name
+
+        [name, packaging_type(pom, node), dependency_classifier(node, pom).to_s].join(":")
+      end
+
       sig do
         params(
           dependency_node: Nokogiri::XML::Element,

data/lib/dependabot/maven/file_updater/declaration_finder.rb

@@ -20,6 +20,17 @@ module Dependabot
               <path>.*?</path>|
               <artifactItem>.*?</artifactItem>
             }mx
+
+        # The parts of a requirement the XML match depends on. Scanned-only requirements have no XML
+        # entry and are pinned per `pom_file`, so they're kept whole.
+        sig { params(requirement: Dependabot::DependencyRequirement).returns(Object) }
+        def self.match_key(requirement)
+          return requirement unless requirement.file
+
+          [requirement.file, requirement.requirement_string, requirement.groups] +
+            %w(packaging_type classifier property_name property_source).map { |key| requirement.metadata_string(key) }
+        end
+
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
@@ -137,13 +148,13 @@ module Dependabot
           type == packaging_type(node)
         end
 
+        # A classifier names a distinct artifact, so an entry only matches the requirement parsed from
+        # an entry with the same classifier (none for the plain artifact).
         sig { params(node: Nokogiri::XML::Document).returns(T::Boolean) }
         def classifier_matches?(node)
-          return true unless node.at_xpath("./*/classifier")
-
-          classifier = evaluated_value(node.at_xpath("./*/classifier").content.strip)
-          dep_classifier = dependency.requirements.first&.metadata_string("classifier")
-          classifier == dep_classifier
+          classifier_node = node.at_xpath("./*/classifier")
+          classifier = classifier_node && evaluated_value(classifier_node.content.strip)
+          classifier == declaring_requirement.metadata_string("classifier")
         end
 
         sig { params(node: Nokogiri::XML::Document).returns(T::Boolean) }

data/lib/dependabot/maven/file_updater.rb

@@ -134,13 +134,8 @@ module Dependabot
       def update_files_for_dependency(original_files:, dependency:)
         files = original_files.dup
 
-        # The UpdateChecker ensures the order of requirements is preserved
-        # when updating, so we can zip them together in new/old pairs.
-        reqs = dependency.requirements.zip(dependency.previous_requirements.to_a)
-                         .reject { |new_req, old_req| new_req == old_req }
-
         # Loop through each changed requirement and update the files
-        reqs.each do |new_req, old_req|
+        changed_requirement_pairs(dependency).each do |new_req, old_req|
           raise "Bad req match" unless new_req.file == T.must(old_req).file
           next if new_req.requirement == T.must(old_req).requirement
 
@@ -161,6 +156,15 @@ module Dependabot
       end
       # rubocop:enable Metrics/AbcSize
 
+      # Requirement order is preserved, so new/old pairs zip together. One rewrite changes every XML
+      # entry that matches it, so pairs that differ only in other metadata (the override tag, or what
+      # the dependency tree scan merged into one of them) collapse into one.
+      sig { params(dependency: Dependency).returns(T::Array[[DependencyRequirement, T.nilable(DependencyRequirement)]]) }
+      def changed_requirement_pairs(dependency)
+        dependency.requirements.zip(dependency.previous_requirements.to_a).reject { |new, old| new == old }
+                  .uniq { |pair| pair.map { |req| req && DeclarationFinder.match_key(req) } }
+      end
+
       sig do
         params(
           pomfiles: T::Array[Dependabot::DependencyFile],

data/lib/dependabot/maven/shared/shared_package_details_fetcher.rb

@@ -112,6 +112,7 @@ module Dependabot
             headers: headers
           )
           check_response(response, url)
+          check_unavailable_response(response, url)
           return unless response.status < 400
 
           Nokogiri::XML(response.body)
@@ -223,6 +224,23 @@ module Dependabot
           forbidden_urls << repository_url
         end
 
+        # A rate limit or server error means the repository could not be read, not
+        # that it has no versions. Raises for the central repo; for other repos the
+        # URL is recorded so we can raise if no repository returned any versions.
+        sig { params(response: Excon::Response, repository_url: String).void }
+        def check_unavailable_response(response, repository_url)
+          return unless response.status == 429 || response.status >= 500
+
+          if base_repository_urls.include?(strip_trailing_slashes(repository_url))
+            raise RegistryError.new(
+              response.status,
+              "RegistryError: #{response.status} response status from #{repository_url}"
+            )
+          end
+
+          unavailable_urls << repository_url unless unavailable_urls.include?(repository_url)
+        end
+
         # Raises RegistryError for failures hitting the central repo.
         sig do
           params(
@@ -289,6 +307,7 @@ module Dependabot
         sig { returns(T::Array[VersionDetails]) }
         def versions_details_from_xml
           forbidden_urls.clear
+          unavailable_urls.clear
           version_details = repositories.flat_map do |repository_details|
             url = repository_url(repository_details)
             xml = dependency_metadata(repository_details)
@@ -298,6 +317,7 @@ module Dependabot
           end
 
           raise PrivateSourceAuthenticationFailure, forbidden_urls.first if version_details.none? && forbidden_urls.any?
+          raise PrivateSourceBadResponse, unavailable_urls.first if version_details.none? && unavailable_urls.any?
 
           version_details
         end
@@ -390,9 +410,9 @@ module Dependabot
         end
 
         # Both HTTP and HTTPS variants of the central repo URL, for comparison.
-        sig { returns(T::Array[String]) }
-        def central_repo_urls
-          central_url_without_protocol = central_repo_url.gsub(%r{^.*://}, "")
+        sig { params(url: String).returns(T::Array[String]) }
+        def central_repo_urls(url = central_repo_url)
+          central_url_without_protocol = url.gsub(%r{^.*://}, "")
           %w(http:// https://).map { |p| p + central_url_without_protocol }
         end
 
@@ -401,6 +421,24 @@ module Dependabot
           @forbidden_urls ||= T.let([], T.nilable(T::Array[String]))
         end
 
+        # Maven Central and any registry that replaces it. Central is kept even when
+        # replaced, since a POM may still list it explicitly.
+        sig { returns(T::Array[String]) }
+        def base_repository_urls
+          replaces_base = credentials.filter_map { |c| c[URL_KEY] if c["type"] == REPOSITORY_TYPE && c.replaces_base? }
+          (central_repo_urls(DEFAULT_CENTRAL_REPO_URL) + replaces_base).map { |url| strip_trailing_slashes(url) }
+        end
+
+        sig { params(url: String).returns(String) }
+        def strip_trailing_slashes(url)
+          url.dup.tap { |u| u.delete_suffix!("/") while u.end_with?("/") }
+        end
+
+        sig { returns(T::Array[String]) }
+        def unavailable_urls
+          @unavailable_urls ||= T.let([], T.nilable(T::Array[String]))
+        end
+
         # -- Auth --
 
         sig { params(maven_repo_url: String).returns(T::Hash[String, String]) }

data/lib/dependabot/maven/update_checker/property_updater.rb

@@ -14,6 +14,7 @@ module Dependabot
         extend T::Sig
 
         require_relative "requirements_updater"
+        require_relative "transitive_overrides"
         require_relative "version_finder"
 
         sig do
@@ -23,7 +24,8 @@ module Dependabot
             credentials: T::Array[Dependabot::Credential],
             ignored_versions: T::Array[String],
             target_version_details: T.nilable(UpdateChecker::VersionDetails),
-            update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+            update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+            security_update: T::Boolean
           ).void
         end
         def initialize(
@@ -32,7 +34,8 @@ module Dependabot
           credentials:,
           ignored_versions:,
           target_version_details:,
-          update_cooldown: nil
+          update_cooldown: nil,
+          security_update: false
         )
           @dependency       = dependency
           @dependency_files = dependency_files
@@ -43,6 +46,7 @@ module Dependabot
           @target_version = T.let(target_version, T.nilable(Dependabot::Maven::Version))
           @source_url = T.let(target_version_details&.fetch(:source_url), T.nilable(String))
           @update_cooldown = update_cooldown
+          @security_update = security_update
           @property_value_finder = T.let(nil, T.nilable(Dependabot::Maven::FileParser::PropertyValueFinder))
         end
 
@@ -123,13 +127,21 @@ module Dependabot
         sig { returns(T::Array[Dependabot::Dependency]) }
         def dependencies_using_property
           @dependencies_using_property ||= T.let(
+            parsed_dependencies.select do |dep|
+              dep.requirements.any? { |requirement| uses_property?(requirement) }
+            end,
+            T.nilable(T::Array[Dependabot::Dependency])
+          )
+        end
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        def parsed_dependencies
+          @parsed_dependencies ||= T.let(
             Maven::FileParser.new(
               dependency_files: dependency_files,
               source: nil,
               options: { skip_dependency_tree: true }
-            ).parse.select do |dep|
-              dep.requirements.any? { |requirement| uses_property?(requirement) }
-            end,
+            ).parse,
             T.nilable(T::Array[Dependabot::Dependency])
           )
         end
@@ -156,7 +168,9 @@ module Dependabot
 
         sig { returns(Dependabot::DependencyRequirement) }
         def property_requirement
-          property_requirements = dependency.requirements.select { |r| r.metadata_string("property_name") }
+          property_requirements = TransitiveOverrides.raisable_property_requirements(
+            dependency.requirements, security_update: @security_update
+          ) { parsed_dependencies }
           matching_requirement = property_requirements.find do |requirement|
             normalized_requirement_version(requirement) == dependency.version
           end
@@ -255,12 +269,25 @@ module Dependabot
               source_url: source_url,
               properties_to_update: [property_name]
             ).updated_requirements.map.with_index do |requirement, index|
+              next dep.requirements.fetch(index) if keep_unchanged?(dep, dep.requirements.fetch(index))
               next requirement unless requirement.metadata_string("property_name")
 
               uses_property?(requirement) ? requirement : dep.requirements.fetch(index)
             end
         end
 
+        # A literal transitive override isn't tied to the shared property, so the property update leaves
+        # it, and any declaration whose rewrite would also hit it, alone. Only a security update raises
+        # it, and only for the vulnerable dependency.
+        sig { params(dep: Dependabot::Dependency, requirement: Dependabot::DependencyRequirement).returns(T::Boolean) }
+        def keep_unchanged?(dep, requirement)
+          return false if @security_update && dep.name == dependency.name
+          return false if requirement.metadata_string("property_name")
+
+          TransitiveOverrides.override?(requirement) ||
+            TransitiveOverrides.rewrites_an_override?(requirement, dep.requirements)
+        end
+
         sig { params(dep: Dependabot::Dependency).returns(T::Boolean) }
         def writable_requirements?(dep)
           updated = updated_requirements(dep)

data/lib/dependabot/maven/update_checker/transitive_overrides.rb

@@ -0,0 +1,87 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/dependency_requirement"
+require "dependabot/maven/update_checker"
+
+module Dependabot
+  module Maven
+    class UpdateChecker
+      # Rules for keeping transitive overrides (tagged by the file parser) out of version updates.
+      module TransitiveOverrides
+        extend T::Sig
+
+        sig { params(requirement: Dependabot::DependencyRequirement).returns(T::Boolean) }
+        def self.override?(requirement)
+          requirement.metadata_boolean("transitive_override") == true
+        end
+
+        # The file updater rewrites every XML entry that matches a declaration's file, literal version,
+        # packaging type, scope (ignored for plugins) and classifier. A declaration that matches a kept
+        # override that way can't change on its own, so it's held too.
+        sig do
+          params(
+            requirement: Dependabot::DependencyRequirement,
+            requirements: T::Array[Dependabot::DependencyRequirement]
+          ).returns(T::Boolean)
+        end
+        def self.rewrites_an_override?(requirement, requirements)
+          return false if override?(requirement) || property?(requirement)
+
+          requirements.any? { |other| override?(other) && rewrites?(requirement, other) }
+        end
+
+        # Outside a security update an override follows a version property only when a declaration
+        # also uses it. A property only overrides use is never raised, so it can't drive an update.
+        sig do
+          params(
+            requirements: T::Array[Dependabot::DependencyRequirement],
+            security_update: T::Boolean,
+            dependencies: T.proc.returns(T::Array[Dependabot::Dependency])
+          ).returns(T::Array[Dependabot::DependencyRequirement])
+        end
+        def self.raisable_property_requirements(requirements, security_update:, &dependencies)
+          with_property = requirements.select { |req| property?(req) }
+          return with_property if security_update || with_property.none? { |req| override?(req) }
+
+          declared = (requirements + yield.flat_map(&:requirements)).reject { |req| override?(req) }
+          with_property.select do |req|
+            !override?(req) || declared.any? { |other| same_property?(other, req) }
+          end
+        end
+
+        sig do
+          params(
+            declaration: Dependabot::DependencyRequirement,
+            override: Dependabot::DependencyRequirement
+          ).returns(T::Boolean)
+        end
+        def self.rewrites?(declaration, override)
+          return false if property?(override)
+          return false unless declaration.file == override.file
+          return false unless declaration.requirement_string == override.requirement_string
+          return false unless %w(packaging_type classifier).all? do |key|
+            declaration.metadata_string(key) == override.metadata_string(key)
+          end
+
+          declaration.groups == ["plugin"] || declaration.groups == override.groups
+        end
+        private_class_method :rewrites?
+
+        sig { params(one: Dependabot::DependencyRequirement, other: Dependabot::DependencyRequirement).returns(T::Boolean) }
+        def self.same_property?(one, other)
+          one.metadata_string("property_name") == other.metadata_string("property_name") &&
+            one.metadata_string("property_source") == other.metadata_string("property_source")
+        end
+        private_class_method :same_property?
+
+        sig { params(requirement: Dependabot::DependencyRequirement).returns(T::Boolean) }
+        def self.property?(requirement)
+          !requirement.metadata_string("property_name").nil?
+        end
+        private_class_method :property?
+      end
+    end
+  end
+end

data/lib/dependabot/maven/update_checker.rb

@@ -11,6 +11,7 @@ module Dependabot
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/version_finder"
       require_relative "update_checker/property_updater"
+      require_relative "update_checker/transitive_overrides"
 
       VersionDetails = T.type_alias do
         {
@@ -57,6 +58,16 @@ module Dependabot
         @all_property_based_dependencies = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
       end
 
+      # Transitive overrides hold a version on purpose (often a security fix), so only a
+      # vulnerable one is updated. A dependency set only by overrides is "up to date" otherwise,
+      # which keeps version, grouped and refresh jobs away from it.
+      sig { override.returns(T::Boolean) }
+      def up_to_date?
+        return true if no_updatable_declarations? && !vulnerable?
+
+        super
+      end
+
       sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_version
         version = latest_version_details&.fetch(:version)
@@ -155,12 +166,47 @@ module Dependabot
           declarations_using_a_property
           .filter_map { |req| req.metadata_string("property_name") }
 
-        RequirementsUpdater.new(
+        updated = RequirementsUpdater.new(
           requirements: dependency.requirements,
           latest_version: version&.to_s,
           source_url: preferred_version_details&.fetch(:source_url),
           properties_to_update: property_names
         ).updated_requirements
+        return updated if vulnerable? || dependency.requirements.none? { |req| transitive_override?(req) }
+
+        # Outside a security update only declarations change, plus overrides sharing a property being
+        # raised (they move with it anyway, and must change so their version suffix is normalized).
+        # Other overrides keep their version, and scanned requirements aren't pinned underneath them.
+        dependency.requirements.zip(updated).map do |original, updated_req|
+          updatable_declaration?(original) || follows_raised_property?(original) ? T.must(updated_req) : original
+        end
+      end
+
+      sig { params(requirement: Dependabot::DependencyRequirement).returns(T::Boolean) }
+      def follows_raised_property?(requirement)
+        transitive_override?(requirement) && declarations_using_a_property.include?(requirement)
+      end
+
+      sig { returns(T::Boolean) }
+      def no_updatable_declarations?
+        declared = dependency.requirements.select(&:file)
+        declared.any? && declared.none? { |req| updatable_declaration?(req) }
+      end
+
+      sig { params(requirement: Dependabot::DependencyRequirement).returns(T::Boolean) }
+      def updatable_declaration?(requirement)
+        declared_requirement?(requirement) &&
+          !TransitiveOverrides.rewrites_an_override?(requirement, dependency.requirements)
+      end
+
+      sig { params(requirement: Dependabot::DependencyRequirement).returns(T::Boolean) }
+      def transitive_override?(requirement)
+        TransitiveOverrides.override?(requirement)
+      end
+
+      sig { params(requirement: Dependabot::DependencyRequirement).returns(T::Boolean) }
+      def declared_requirement?(requirement)
+        !requirement.file.nil? && !transitive_override?(requirement)
       end
 
       sig { override.returns(T::Boolean) }
@@ -230,7 +276,8 @@ module Dependabot
             target_version_details: latest_version_details,
             credentials: credentials,
             ignored_versions: ignored_versions,
-            update_cooldown: update_cooldown
+            update_cooldown: update_cooldown,
+            security_update: vulnerable?
           )
       end
 
@@ -262,8 +309,9 @@ module Dependabot
       sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def declarations_using_a_property
         @declarations_using_a_property ||=
-          dependency.requirements
-                    .select { |req| req.metadata_string("property_name") }
+          TransitiveOverrides.raisable_property_requirements(dependency.requirements, security_update: vulnerable?) do
+            all_property_based_dependencies
+          end
       end
 
       sig { returns(T::Array[Dependabot::Dependency]) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.403.0
+  version: 0.404.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.403.0
+        version: 0.404.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.403.0
+        version: 0.404.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -263,6 +263,7 @@ files:
 - lib/dependabot/maven/file_parser/pom_fetcher.rb
 - lib/dependabot/maven/file_parser/property_value_finder.rb
 - lib/dependabot/maven/file_parser/repositories_finder.rb
+- lib/dependabot/maven/file_parser/transitive_override_finder.rb
 - lib/dependabot/maven/file_parser/wrapper_mojo.rb
 - lib/dependabot/maven/file_updater.rb
 - lib/dependabot/maven/file_updater/declaration_finder.rb
@@ -289,6 +290,7 @@ files:
 - lib/dependabot/maven/update_checker.rb
 - lib/dependabot/maven/update_checker/property_updater.rb
 - lib/dependabot/maven/update_checker/requirements_updater.rb
+- lib/dependabot/maven/update_checker/transitive_overrides.rb
 - lib/dependabot/maven/update_checker/version_finder.rb
 - lib/dependabot/maven/utils/auth_headers_finder.rb
 - lib/dependabot/maven/version.rb
@@ -298,7 +300,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.403.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.404.0
 rdoc_options: []
 require_paths:
 - lib