Do not record Maven compile scope in dependency groups (#1003)

We should only record non-default dependency groups. For Maven, `compile` is the default scope so it should not be recorded. https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#dependency-scope
google · May 30, 2024 · e94c6b5 · e94c6b5
1 parent d4657bf
commit e94c6b5
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 4 deletions.
diff --git a/pkg/lockfile/fixtures/maven/with-scope.xml b/pkg/lockfile/fixtures/maven/with-scope.xml
@@ -1,5 +1,11 @@
 <project>
   <dependencies>
+    <dependency>
+      <groupId>abc</groupId>
+      <artifactId>xyz</artifactId>
+      <version>1.2.3</version>
+      <scope>compile</scope>
+    </dependency>
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>

diff --git a/pkg/lockfile/parse-maven-lock.go b/pkg/lockfile/parse-maven-lock.go
@@ -130,8 +130,9 @@ func (e MavenLockExtractor) Extract(f DepFile) ([]PackageDetails, error) {
 			Ecosystem: MavenEcosystem,
 			CompareAs: MavenEcosystem,
 		}
-		if strings.TrimSpace(lockPackage.Scope) != "" {
-			pkgDetails.DepGroups = append(pkgDetails.DepGroups, lockPackage.Scope)
+		if scope := strings.TrimSpace(lockPackage.Scope); scope != "" && scope != "compile" {
+			// Only append non-default scope (compile is the default scope).
+			pkgDetails.DepGroups = append(pkgDetails.DepGroups, scope)
 		}
 		details[finalName] = pkgDetails
 	}
@@ -145,8 +146,9 @@ func (e MavenLockExtractor) Extract(f DepFile) ([]PackageDetails, error) {
 			Ecosystem: MavenEcosystem,
 			CompareAs: MavenEcosystem,
 		}
-		if strings.TrimSpace(lockPackage.Scope) != "" {
-			pkgDetails.DepGroups = append(pkgDetails.DepGroups, lockPackage.Scope)
+		if scope := strings.TrimSpace(lockPackage.Scope); scope != "" && scope != "compile" {
+			// Only append non-default scope (compile is the default scope).
+			pkgDetails.DepGroups = append(pkgDetails.DepGroups, scope)
 		}
 		details[finalName] = pkgDetails
 	}

diff --git a/pkg/lockfile/parse-maven-lock_test.go b/pkg/lockfile/parse-maven-lock_test.go
@@ -301,6 +301,12 @@ func TestParseMavenLock_WithScope(t *testing.T) {
 	}
 
 	expectPackages(t, packages, []lockfile.PackageDetails{
+		{
+			Name:      "abc:xyz",
+			Version:   "1.2.3",
+			Ecosystem: lockfile.MavenEcosystem,
+			CompareAs: lockfile.MavenEcosystem,
+		},
 		{
 			Name:      "junit:junit",
 			Version:   "4.12",