[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

Stacked on #1716, since both change how the Maven extension walks a module's graph.

Maven Socket facts kept only Maven 3's five scopes and silently dropped every other dependency, subtree included. That covered Maven 4's compile-only, test-only, test-runtime and none, and an import or misspelled scope in <dependencies>. Maven 3 compiles and runs against such a jar, so this was both an SBOM miss and a reachability blind spot.

What changes

• A scope Maven 3 doesn't define is prod, as Maven 3 puts its jar on every classpath. A scope Maven 4 doesn't define follows the same rule, as Maven 4's default plugins do.
• Maven 4's compile-only, test-only and test-runtime are dev, on the compile or test path its PathScope gives them.
• Maven 4's none is on no path. The dependency and its subtree stay in the SBOM as dev, in a root that a new noClasspath record marks. The assembler leaves them off the reachability classpath and the sidecar's direct dependencies, so Coana neither analyses nor fetches them.
• --include-configs and --exclude-configs match any scope name.

These rules follow a measured comparison: Maven 3.9.9 and 4.0.0-rc-6, and the CycloneDX Maven plugin, cdxgen, Trivy and Syft. The decisions are recorded in REA-1164.

Verification

• New maven-compat/unknown-scopes fixture, on every Maven version: import and misspelled scopes, each with a child. Prod, on the classpath.
• New maven-compat/maven4-scopes fixture, on the Maven 4 row: the four Maven 4 scopes, plus a none dependency sharing a child with a compile one, whose edge is kept.
• The previous extension misses both.
• Maven compat matrix 3.2.5 to 4.0.0-rc-6 is green.

Resolves REA-1164.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes core Maven dependency graph emission and reachability classpath boundaries; mistakes could mis-classify scopes or omit/exclude the wrong dependencies from scans.

Overview
Maven Socket facts no longer silently drop dependencies whose scope is outside Maven 3’s fixed five (compile, provided, runtime, system, test). The Maven extension replaces the hard-coded scope list with a Scopes helper that distinguishes Maven 3 vs Maven 4, honors --include-configs / --exclude-configs for any scope name, and labels each node prod/dev and on/off classpath the way Maven treats that scope (e.g. unknown scopes stay prod and on every classpath; Maven 4’s compile-only / test-only / test-runtime are dev; none is off all paths).

Off-classpath resolution (notably none) is emitted in a separate root with a new noClasspath record so the full subtree stays in the SBOM but is excluded from artifact fetch and from reachability. The assembler tracks per-root onClasspath, builds classpathByProject from classpath roots only, and limits direct dependencies to those on the classpath.

Regression coverage adds unknown-scopes and maven4-scopes compat fixtures plus smoke-test-scopes.sh in the Maven matrix.

^{Reviewed by Cursor Bugbot for commit ff82596. Configure here.}

[Martin Torp (mtorp)]

LGTM ✅