fix: preserve dependencies from version-range winners

[efegokdemir]

Superseded by apache/maven-resolver#2208. The missing dependencies reproduce in Maven 3.10.0 and Maven 4.0.0-rc-7 and originate in Resolver 2.x breadth-first collection skipping a range-constrained candidate. Setting the global skipper to versioned in Maven is not the root fix; it changes collection broadly and the reported graph exhausted memory with that setting on Maven 4.0.0-rc-7. The targeted Resolver fix is under review in #2208, so no Maven-core change is proposed here.

• I hereby declare this contribution to be licensed under the Apache License Version 2.0, January 2004
• I hereby declare that I have filed an Apache Individual Contributor License Agreement.

[gnodet-bot]

Review: fix: preserve dependencies from version-range winners

This is a correct and well-targeted fix. The aether.dependencyCollector.bf.skipper defaulting to versionless in the resolver causes transitive dependencies of version-range winners to be silently dropped when a different version was visited first during BFS traversal. Overriding to versioned at the Maven layer is the right approach — it's consistent with how other resolver defaults are managed in DefaultRepositorySystemSessionFactory.

✅ Fix logic is correct — the !mergedProps.containsKey(...) guard correctly respects user overrides before setting the Maven default.

✅ Test covers both paths: default versioned and user override to versionless.

Nit: The new constant MAVEN_RESOLVER_BF_COLLECTOR_SKIPPER is declared between the transport constants MAVEN_RESOLVER_TRANSPORT_DEFAULT and MAVEN_RESOLVER_TRANSPORT_WAGON. Since these transport constants form a cohesive group, the new constant would be less disruptive placed either before the transport group or after the last transport constant.

Questions for the author:

1. The !mergedProps.containsKey() guard prevents overriding user-set properties — was configProps vs mergedProps merge order also reviewed? (i.e. does configProps.putAll happen after this block, or could the user value in configProps already shadow the guard's intent?)

2. Is this fix needed on Maven 3.9.x? (Maven 3.9.x depends on a different resolver version — the bf.skipper behavior may differ there.)

3. Missing backport: If this fixes a regression in Maven 4.0.x or 3.10.x, a backport PR should be opened. Could you clarify which versions are affected?

This review was generated by an AI agent, Hermès on behalf of @gnodet.

[gnodet-bot]

Re-review: fix: preserve dependencies from version-range winners

Nit addressed ✅ — the MAVEN_RESOLVER_BF_COLLECTOR_SKIPPER constant is now correctly placed before the transport constants. Good cleanup.

The fix logic remains correct: the !mergedProps.containsKey(...) guard properly respects user overrides, and the test covers both the default (versioned) and override (versionless) paths.

Two items still pending:

1. License checkbox unchecked — the Apache License checkbox in the PR description is not checked. Please check it before this can be merged.

2. Backport to maven-4.0.x — if this fixes a regression present in the 4.0.x line (the resolver BF skipper behavior affects both), a backport PR targeting maven-4.0.x should be opened.

This review was generated by an AI agent, Hermès on behalf of @gnodet.