[maven-4.0.x] DefaultModelBuilder: BOM import dependencies incorrectly skipped due to operator precedence

[elharo]

DefaultModelBuilder: BOM import dependencies incorrectly skipped due to operator precedence

Found in: maven-4.0.x branch
File: impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java (lines 2010-2011)
Severity: High

Description

Due to operator precedence, BOM-type dependencies in dependencyManagement are always skipped:

if (!("pom".equals(dependency.getType()) && "import".equals(dependency.getScope()))
        || "bom".equals(dependency.getType())) {
    continue;
}

This evaluates as (!(pom && import)) || bom, which is equivalent to (!pom || !import || bom). The || "bom".equals(...) clause causes BOM-type dependencies to ALWAYS hit continue, meaning they are skipped and never processed as import management.

The correct condition should be:

if (!("pom".equals(dependency.getType()) && "import".equals(dependency.getScope()))
        && !"bom".equals(dependency.getType())) {
    continue;
}

BOM imports in dependencyManagement sections are silently ignored.