[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

REA-1056. A Maven relocation (e.g. mysql:mysql-connector-java) made sbt facts fail with Resolved dependencies of <project> are not reachable: coursier reports the target with the relocating module as its caller, but leaves that module out of the report. The plugin now reads the relocation POMs and attaches the target to whoever declared the relocating module:

• the project, when it declares it in a configuration the root includes;
• a dependsOn project, likewise;
• a library whose POM passes it on (compile or runtime scope, declared or managed, not optional).

The target may resolve to a different version than the relocation names (conflict resolution, overrides). Ivy keeps the relocating module and is unaffected.

Tested: run-compat.sh sbt (0.13.18 to 1.9.9, plus Ivy). A new relocation fixture covers a direct declaration, a version range, a version override, a dependsOn declarer and a test-scoped library declaration; it fails on v1.x. make-stub-repo.sh gains relocation POMs, dependency scopes and maven-metadata.xml.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes sbt dependency graph emission for Coursier-backed builds via new POM parsing and heuristic parent linking; wrong edges could skew SBOM/reachability, but behavior is scoped to missing relocation callers and is covered by the compat matrix.

Overview
Fixes sbt Socket facts / SBOM generation when dependencies use Maven relocations (e.g. mysql:mysql-connector-java). Coursier resolves the target artifact but omits the relocating module and its caller from the update report, which broke dependency reachability and failed the run.

The sbt plugin socket-facts.plugin.scala now reconstructs caller edges when a missing caller is a relocation: it reads cached POMs (relocation blocks, inherited dependencies, managed scopes, BOM imports) and links the target to who actually declared the old coordinate—the root project, a dependsOn subproject (using reached configs), or a transitive library whose POM passes the dependency on at compile/runtime and is not optional. Ivy is unchanged. PomPackaging is expanded for this POM work; jar-vs-pom-only handling reuses the same parser.

Compat tests add relocation stubs (make-stub-repo.sh: relocation specs, @scope deps, maven-metadata.xml), extend the smoke project, a multi-module relocation fixture, and smoke-test-relocation.sh wired into run-compat.sh. Changelog and .gitignore cover the new generated paths.

^{Reviewed by Cursor Bugbot for commit 0e0bcce. Configure here.}