Fail to update Maven packages with properties in their names

Author: michaelkedarCreated Sep 11, 2024Updated Sep 16, 2026

Labelsbugguided remediationbacklog

If a Maven dependency uses a property in its artifactId or groupId, the writer does not find the original definition of the package and will end up creating a new section for the patch.

e.g. Starting with this:

xml

<properties>
  <artifact>foo</artifact>
</properties>
<dependencies>
  <dependency>
    <groupId>com.xyz</groupId>
    <artifactId>${artifact}</artifactId>
    <version>1.0.0</version>
  </dependency>
</dependencies>

A patch to com.xyz:foo will end up looking like:

xml

<properties>
  <artifact>foo</artifact>
</properties>
<dependencies>
  <dependency>
    <groupId>com.xyz</groupId>
    <artifactId>${artifact}</artifactId>
    <version>1.0.0</version>
  </dependency>
</dependencies>
<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.xyz</groupId>
      <artifactId>foo</artifactId>
      <version>2.0.0</version>
    </dependency>
  </dependencies>
</dependencyManagement>

Which, in this case, does not actually override the version of the package (despite the override claiming it would).

Source: google/osv-scanner

View original on GitHub View discussion on GitHub