Fully resolve BOM POMs

[brunoapimentel]

The issue of BOM POM resolution has only been partially solved by closing #1483.

The current solution needs to be improved so it also covers BOMs of:

• parent POMs
• plugin depedencies
• other BOM POMs

Examples

BOM of a parent POM

• com.google.protobuf:protobuf-java:4.33.5
  • org.apache.maven:maven-core:3.9.12
    • org.apache.maven:maven-artifact:3.9.12
      • org.apache.maven:maven:3.9.12 (parent)
        • org.junit:junit-bom:5.13.1 (BOM)

Found in kserve/modelmesh@0604dff

BOM of plugin dependencies

• io.github.ascopes:protobuf-maven-plugin:5.0.0
  • org.apache.commons:commons-compress:1.28.0
    • commons-codec:commons-codec:1.19.0
      • org.junit:junit-bom:5.13.1 (BOM)

Found in kserve/modelmesh@0604dff

BOM of another BOM

• org.springframework.boot:spring-boot-starter-parent:4.0.0 (parent)
  • org.springframework.boot:spring-boot-dependencies:4.0.0 (parent)
    • org.neo4j.driver:neo4j-java-driver-bom:6.0.2 (BOM)
    • org.neo4j.bolt:neo4j-bolt-connection-bom:10.1.0 (BOM)

Found in a generated Spring boot template project.

[algomaster99]

Thanks for opening this! Linking this comment thread too.

BOM of a parent POM

* com.google.protobuf:protobuf-java:4.33.5
  
  * org.apache.maven:maven-core:3.9.12
    
    * org.apache.maven:maven-artifact:3.9.12
      
      * org.apache.maven:maven:3.9.12 (parent)
        
        * org.junit:junit-bom:5.13.1 (BOM)

I started traversing through the project you linked. I found the following to be the correct graph. It still falls under "BOM of a parent POM".

• com.google.protobuf:protobuf-java:4.33.5
  • com.google.protobuf:protobuf-parent:3.25.5 (parent)
    • com.google.protobuf:protobuf-bom:3.25.5 (BOM)