[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

REA-1055. Maven facts dropped a module's dependencies when it reached a sibling through both its jar and its test-jar and Maven kept those dependencies under the test-jar only. The walk now visits each artifact once instead of each node.

Tested: run-compat.sh maven (3.2.5 to 4.0.0-rc-6). The fixture adds this shape (app → mid → lib, plus lib's test-jar); its new check fails on v1.x.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes Maven dependency-tree emission logic used for SBOMs and reachability; scope is narrow (visit deduplication) but incorrect graphs would affect scan completeness.

Overview
Fixes Maven Socket facts / SBOM generation dropping transitive dependencies when a reactor module is reachable through both its normal jar (e.g. via another module) and its test-jar, and Maven attaches those transitives only under the test-jar node.

In SocketFactsRecordsEngine.visit, deduplication for the graph walk now keys the visited set on externalId (full coordinate, including type) instead of the emitted node id. Reactor siblings still use bare ids for records, but jar and test-jar paths can both be walked so children recorded only on the test-jar branch (such as demo.ext:libdep under lib) are merged into the same internal component.

The maven-compat fixture adds mid → lib, lib → libdep, and app’s test-scoped lib test-jar; smoke tests assert libdep appears in app’s graph and document the scenario in CHANGELOG.

^{Reviewed by Cursor Bugbot for commit c4ca3eb. Configure here.}