Properties used in Maven dependencyManagement not picked up correctly

[wollefitz]

Dependabot doesn't correctly pick up versions that are stored in Maven properties and used in dependencyManagement sections. I created a sample repository to analyze the issue a little more in-depth.

• When letting Dependabot run on the repository's master branch (no effective dependencies, just a dependencyManagement block) I'm getting the following error:

Dependabot can't evaluate your Java dependency files.

As a result, Dependabot couldn't check whether any of your dependencies are out-of-date.

The error Dependabot encountered was:

Property not found: project.version.spring-boot

See also this issue Dependabot created

• When letting Dependabot run on a branch where I added a dependency on org.springframework.boot:spring-boot-starter-web I'm not getting the above error anymore but Dependabot doesn't create a Pull Request to bump project.version.spring-boot even though it understands that currently the latest version is 2.2.4.RELEASE:

updater | INFO <job_24269133> Checking if org.springframework.boot:spring-boot-starter-web  needs updating
  proxy | 2020/02/24 11:41:40 GET https://repo1.maven.org:443/maven2/org/springframework/boot/spring-boot-starter-web/maven-metadata.xml
  proxy | 2020/02/24 11:41:40 200 https://repo1.maven.org:443/maven2/org/springframework/boot/spring-boot-starter-web/maven-metadata.xml
  proxy | 2020/02/24 11:41:40 GET https://repo.maven.apache.org:443/maven2/org/springframework/boot/spring-boot-starter-web/maven-metadata.xml
  proxy | 2020/02/24 11:41:40 200 https://repo.maven.apache.org:443/maven2/org/springframework/boot/spring-boot-starter-web/maven-metadata.xml
  proxy | 2020/02/24 11:41:40 HEAD https://repo1.maven.org:443/maven2/org/springframework/boot/spring-boot-starter-web/2.2.4.RELEASE/spring-boot-starter-web-2.2.4.RELEASE.jar
  proxy | 2020/02/24 11:41:40 200 https://repo1.maven.org:443/maven2/org/springframework/boot/spring-boot-starter-web/2.2.4.RELEASE/spring-boot-starter-web-2.2.4.RELEASE.jar
updater | INFO <job_24269133> Latest version is 2.2.4.RELEASE
updater | INFO <job_24269133> No update needed for org.springframework.boot:spring-boot-starter-web 

• I first suspected that using spring-boot-dependencies was the reason for Dependabot not picking up the latest version. But when letting Dependabot run against a branch where I added an effective dependency to lombok that could be picked up directly from the dependencyManagement block I'm still getting the same error:

updater | INFO <job_24269470> Checking if org.projectlombok:lombok  needs updating
  proxy | 2020/02/24 11:57:02 GET https://repo1.maven.org:443/maven2/org/projectlombok/lombok/maven-metadata.xml
  proxy | 2020/02/24 11:57:02 200 https://repo1.maven.org:443/maven2/org/projectlombok/lombok/maven-metadata.xml
  proxy | 2020/02/24 11:57:02 GET https://repo.maven.apache.org:443/maven2/org/projectlombok/lombok/maven-metadata.xml
  proxy | 2020/02/24 11:57:02 200 https://repo.maven.apache.org:443/maven2/org/projectlombok/lombok/maven-metadata.xml
  proxy | 2020/02/24 11:57:02 HEAD https://repo1.maven.org:443/maven2/org/projectlombok/lombok/1.18.12/lombok-1.18.12.jar
  proxy | 2020/02/24 11:57:02 200 https://repo1.maven.org:443/maven2/org/projectlombok/lombok/1.18.12/lombok-1.18.12.jar
updater | INFO <job_24269470> Latest version is 1.18.12
updater | INFO <job_24269470> No update needed for org.projectlombok:lombok 

[jurre]

It looks like this issue has been open for a while and we’ve made a bunch of improvements to Dependabot since, is this still happening, or has this problem been resolved and can we close this issue?

[jeffwidman]

Closing due to lack of user response.

[wollefitz]

@jeffwidman Sorry for the late response, I missed the last comment. I just checked the above-mentioned sample repo again and can confirm that the issue still persists, see this log:

updater | INFO <job_594304459> Starting job processing
updater | INFO <job_594304459> Starting update job for wollefitz/dependabot-maven-properties
updater | INFO <job_594304459> Checking if org.projectlombok:lombok  needs updating
  proxy | 2023/02/01 17:02:46 [010] GET https://repo1.maven.org:443/maven2/org/projectlombok/lombok/maven-metadata.xml
  proxy | 2023/02/01 17:02:46 [010] 200 https://repo1.maven.org:443/maven2/org/projectlombok/lombok/maven-metadata.xml
  proxy | 2023/02/01 17:02:46 [012] HEAD https://repo1.maven.org:443/maven2/org/projectlombok/lombok/1.18.24/lombok-1.18.24.jar
  proxy | 2023/02/01 17:02:46 [012] 200 https://repo1.maven.org:443/maven2/org/projectlombok/lombok/1.18.24/lombok-1.18.24.jar
updater | INFO <job_594304459> Latest version is 1.18.24
updater | INFO <job_594304459> No update needed for org.projectlombok:lombok 
updater | INFO <job_594304459> Checking if org.springframework.boot:spring-boot-starter-web  needs updating
  proxy | 2023/02/01 17:02:46 [014] GET https://repo1.maven.org:443/maven2/org/springframework/boot/spring-boot-starter-web/maven-metadata.xml
  proxy | 2023/02/01 17:02:46 [014] 200 https://repo1.maven.org:443/maven2/org/springframework/boot/spring-boot-starter-web/maven-metadata.xml
  proxy | 2023/02/01 17:02:46 [016] HEAD https://repo1.maven.org:443/maven2/org/springframework/boot/spring-boot-starter-web/3.0.2/spring-boot-starter-web-3.0.2.jar
  proxy | 2023/02/01 17:02:46 [016] 200 https://repo1.maven.org:443/maven2/org/springframework/boot/spring-boot-starter-web/3.0.2/spring-boot-starter-web-3.0.2.jar
updater | INFO <job_594304459> Latest version is 3.0.2
updater | INFO <job_594304459> No update needed for org.springframework.boot:spring-boot-starter-web 
updater | INFO <job_594304459> Finished job processing

Dependabot is able to deduct the latest versions of the used dependencies but fails to compare them against the version that are actually used (see https://github.com/wollefitz/dependabot-maven-properties/network/dependencies).

[deivid-rodriguez]

Just checked #6581 against your sample project and it also fixes this issue 🎉