From cc488b90764234c2ee8846bff80db7ce1be2db28 Mon Sep 17 00:00:00 2001
From: Jay Hemnani <193022578+jayhemnani9910@users.noreply.github.com>
Date: Wed, 21 Oct 2026 00:20:58 +0530
Subject: [PATCH] fix(manifest_ingest): read only a POM's own dependencies

_parse_pom collected every <dependency> in the file with
".//dependencies/dependency", including <dependencyManagement> entries,
which only pin versions, and the <dependencies> of build plugins. Each
became a depends_on edge, so a parent POM that manages its modules'
versions depended on every module.

Read <dependencies> under <project> and under <profiles><profile>, where
Maven takes a project's dependencies from.

(cherry picked from commit 534177d1eada2ee1600749a58b65e53d56a36108)
---
 graphify/manifest_ingest.py   |  5 ++++-
 tests/test_manifest_ingest.py | 23 +++++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/graphify/manifest_ingest.py b/graphify/manifest_ingest.py
index bffb7bc3b..58c1620ee 100644
--- a/graphify/manifest_ingest.py
+++ b/graphify/manifest_ingest.py
@@ -320,7 +320,10 @@ def _parse_pom(text: str) -> dict | None:
     version = _resolve(version)
     name = f"{gid}:{aid}" if gid else aid
     deps: list[str] = []
-    for dep in root.findall(".//dependencies/dependency"):
+    # Only the project's own <dependencies> (and those of its profiles) are
+    # dependencies. <dependencyManagement> only pins versions, and a plugin's
+    # <dependencies> belong to the build tool.
+    for dep in root.findall("dependencies/dependency") + root.findall("profiles/profile/dependencies/dependency"):
         da = _resolve(dep.findtext("artifactId"))
         dg = _resolve(dep.findtext("groupId"))
         if da:
diff --git a/tests/test_manifest_ingest.py b/tests/test_manifest_ingest.py
index 5ddd85583..daec627bb 100644
--- a/tests/test_manifest_ingest.py
+++ b/tests/test_manifest_ingest.py
@@ -75,6 +75,29 @@ def test_pom_parses_artifact_and_deps(tmp_path):
     assert any(e["target"] == "pkg_org_lib_core" for e in r["edges"])
 
 
+
+def test_pom_deps_exclude_managed_and_plugin_dependencies(tmp_path):
+    # <dependencyManagement> only pins versions and a plugin's <dependencies> are
+    # the build tool's; neither is a dependency of the project. Profile
+    # dependencies are.
+    dep = "<dependency><groupId>{}</groupId><artifactId>{}</artifactId></dependency>"
+    p = _write(tmp_path / "pom.xml",
+               '<project xmlns="http://maven.apache.org/POM/4.0.0">\n'
+               '  <groupId>com.acme</groupId><artifactId>service</artifactId><version>1.0</version>\n'
+               f'  <dependencyManagement><dependencies>{dep.format("com.google.guava", "guava")}'
+               '</dependencies></dependencyManagement>\n'
+               f'  <dependencies>{dep.format("org.slf4j", "slf4j-api")}</dependencies>\n'
+               '  <build><plugins><plugin><artifactId>maven-surefire-plugin</artifactId>\n'
+               f'    <dependencies>{dep.format("org.junit.platform", "junit-platform-surefire-provider")}</dependencies>\n'
+               '  </plugin></plugins></build>\n'
+               f'  <profiles><profile><id>pg</id><dependencies>{dep.format("org.postgresql", "postgresql")}'
+               '</dependencies></profile></profiles>\n'
+               '</project>\n')
+    r = extract_package_manifest(p)
+    assert {e["target"] for e in r["edges"] if e["relation"] == "depends_on"} == {
+        "pkg_org_slf4j_slf4j_api", "pkg_org_postgresql_postgresql",
+    }
+
 # ── #1377: a package referenced by N manifests is ONE node ───────────────────
 
 def test_apm_dependency_collapses_to_single_canonical_node(tmp_path):