Fix merge multiple pom imports

[jkroepke]

In maven, a definition of a dependency will not override by any other definition.

% mvn -s testdata/conf/settings.xml -f testdata/import-dependency-management-multiple dependency:tree  | grep example-api
[ERROR] Failed to execute goal on project import: Could not resolve dependencies for project com.example:import:pom:2.0.0: org.example:example-api:jar:1.7.30 was not found in https://repo.maven.apache.org/maven2 during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced -> [Help 1]

Previously, go-dep-parser detects version 1.1.1, since its defined in the second import bom.

See also: aquasecurity/trivy#1943

[CLAassistant]

All committers have signed the CLA.

[knqyf263]

Great contribution! Thanks!!

[knqyf263]

To fix the issue in Trivy, you need to

1. Update fanal pointing to the new go-dep-parser
   • go get -u github.com/aquasecurity/go-dep-parser@71021a481237f5285d64137336479bd3bda91c09 && go mod tidy
2. Update trivy pointing to the updated fanal
   • go get -u github.com/aquasecurity/fanal@[COMMIT_HASH] && go mod tidy

[jkroepke]

Hi @knqyf263

thanks for the instructions. Is there are go mod command to archive this on fanal? Close to zero experience in golang here.

[jkroepke]

Thanks. aquasecurity/fanal#457