Fix reactor BOM imports in also-make graph

[mcc0nnell]

Fixes #11397.

ProjectSorter builds the reactor dependency graph used by -am, but imported BOMs declared under were not represented as reactor edges.

As a result, when one reactor module imports another reactor module as a BOM, for example:

org.example example-bom ${project.version} pom import

running:

mvn -am -pl example-consumer ...

could omit example-bom from the selected reactor even though the consumer depends on it for its effective model. This can cause Maven to use a stale locally installed BOM or fail when the BOM is not already available.

Change

Treat imported BOMs from the project’s original model as reactor graph edges.

The original model is used because BOM import declarations are no longer available in the same form after dependency-management model processing.

Before matching the imported BOM against reactor coordinates, the change resolves:

• ${project.version}
• ${pom.version}
• exact ${property} references available from the project properties

Literal versions continue to be matched directly.

This keeps the behavior in ProjectSorter, so -am and other consumers of the reactor graph see the same dependency relationship rather than adding special handling only to project selection.

Tests

Adds a focused regression test where:

• the consumer is intentionally supplied to ProjectSorter before the BOM;
• the consumer imports the BOM from ;
• the BOM version is ${project.version};
• the resulting graph must contain the BOM as an upstream dependency;
• the BOM must sort before the consumer.

Without the reactor edge, the test fails because the imported BOM is absent from the consumer’s graph dependencies and the original input order is retained.

Verification

Full local mvn verify and the Core IT suite have not been run in this environment because the available shell cannot access external dependencies. Repository CI can perform the full verification.

Following this checklist to help us incorporate your
contribution quickly and easily:

• Your pull request should address just one issue, without pulling in other changes.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Each commit in the pull request should have a meaningful subject line and body.
  Note that commits might be squashed by a maintainer on merge.
• Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied.
  This may not always be possible but is a best-practice.
• Run mvn verify to make sure basic checks pass.
  A more thorough check will be performed on your pull request automatically.
• You have run the Core IT successfully.

If your pull request is about ~20 lines of code you don’t need to sign an
Individual Contributor License Agreement if you are unsure
please ask on the developers list.

To make clear that you license your contribution under
the Apache License Version 2.0, January 2004
you have to acknowledge this by using the following check-box.

• I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004
• In any other case, please file an Apache Individual Contributor License Agreement.

[gnodet]

Good fix for a real gap in the reactor dependency graph. The approach of using getOriginalModel() is correct — BOM import declarations are consumed during model processing, so the effective model doesn't retain them in their original form. The version resolution logic handles the common patterns (${project.version}, ${pom.version}, single property reference) and degrades safely for unresolvable expressions (no edge added, which is correct).

The test is focused and properly asserts both the dependency edge and the sort order.

One nit below.

Backport: The issue (#11397) is labeled mvn3 and was reported against 3.9.11. This PR targets master (4.x). Will this need a backport to maven-3.10.x / maven-3.9.x? The code path exists in both branches — ProjectSorter is shared.

Metadata:

• Category: bug fix
• Suggested labels: bug
• Milestone: suggest 4.1.0

This review was generated by an AI agent, Hermès on behalf of @gnodet.

[gnodet]

💡 Nit: This method doesn't access any instance state — only its parameters. It could be static.

Suggested change

	private String resolveImportVersion(MavenProject project, String version) {
	private static String resolveImportVersion(MavenProject project, String version) {