Add parent POM property inheritance support

- Recursively load properties from parent POMs via <relativePath>
- Support multi-level inheritance (grandparent -> parent -> child)
- Child properties override parent properties as expected
- Handles both explicit and default relativePath (../pom.xml)
- Gracefully handles missing parent POMs with warnings
- Update README to document parent POM support

This enables deptrast to handle most Maven multi-module projects
where dependencies use properties defined in parent POMs.

Author: planetlevel

README.md

@@ -118,8 +118,9 @@ Lines starting with `#` are treated as comments and ignored.
 Standard Maven pom.xml files. Deptrast extracts dependencies from `<dependencies>` blocks with smart handling:
 - **Test-scoped dependencies** - Automatically skipped
 - **Property variables** - Resolved from `<properties>` section (e.g., `${spring.version}`)
+- **Parent POM properties** - Recursively loads properties from parent POMs via `<relativePath>`
 - **Nested properties** - Supports properties that reference other properties
-- **Unresolvable variables** - Skipped with warning (e.g., parent POM properties)
+- **Unresolvable variables** - Skipped with warning (e.g., properties from remote artifacts)
 
 #### Gradle build.gradle / build.gradle.kts
 Gradle build files in Groovy or Kotlin syntax. Supported formats:

src/main/java/com/contrastsecurity/deptrast/util/FileParser.java

@@ -181,9 +181,18 @@ public static List<Package> parsePomFile(String filePath) {
             Document doc = builder.parse(new File(filePath));
             doc.getDocumentElement().normalize();
 
-            // First, parse all properties into a map
-            Map<String, String> properties = parseProperties(doc);
-            logger.info("Loaded {} properties from pom.xml", properties.size());
+            // First, try to load parent POM properties if there's a parent reference
+            Map<String, String> properties = new HashMap<>();
+            Map<String, String> parentProperties = parseParentPomProperties(doc, filePath, factory, builder);
+            if (parentProperties != null && !parentProperties.isEmpty()) {
+                properties.putAll(parentProperties);
+                logger.info("Loaded {} properties from parent pom.xml", parentProperties.size());
+            }
+
+            // Then parse properties from current POM (these override parent properties)
+            Map<String, String> currentProperties = parseProperties(doc);
+            properties.putAll(currentProperties);
+            logger.info("Loaded {} properties total ({} from current pom.xml)", properties.size(), currentProperties.size());
 
             // Find all <dependency> elements
             NodeList dependencyNodes = doc.getElementsByTagName("dependency");
@@ -483,6 +492,73 @@ private static Map<String, String> parseProperties(Document doc) {
         return properties;
     }
 
+    /**
+     * Parse properties from parent POM if it exists
+     *
+     * @param doc current document
+     * @param currentFilePath path to current pom.xml
+     * @param factory DocumentBuilderFactory to reuse
+     * @param builder DocumentBuilder to reuse
+     * @return map of parent properties or empty map
+     */
+    private static Map<String, String> parseParentPomProperties(
+            Document doc,
+            String currentFilePath,
+            DocumentBuilderFactory factory,
+            DocumentBuilder builder) {
+
+        Map<String, String> parentProperties = new HashMap<>();
+
+        try {
+            // Look for <parent> element
+            NodeList parentNodes = doc.getElementsByTagName("parent");
+            if (parentNodes.getLength() == 0) {
+                return parentProperties;
+            }
+
+            Element parentElement = (Element) parentNodes.item(0);
+
+            // Get relativePath (defaults to ../pom.xml if not specified)
+            String relativePath = getElementText(parentElement, "relativePath");
+            if (relativePath == null || relativePath.isEmpty()) {
+                relativePath = "../pom.xml";
+            }
+
+            // Resolve parent POM path relative to current POM
+            Path currentPath = Paths.get(currentFilePath).toAbsolutePath().getParent();
+            Path parentPath = currentPath.resolve(relativePath).normalize();
+
+            // Check if parent POM exists
+            File parentPomFile = parentPath.toFile();
+            if (!parentPomFile.exists()) {
+                logger.warn("Parent POM not found at: {}", parentPath);
+                return parentProperties;
+            }
+
+            logger.info("Found parent POM at: {}", parentPath);
+
+            // Parse parent POM
+            Document parentDoc = builder.parse(parentPomFile);
+            parentDoc.getDocumentElement().normalize();
+
+            // Recursively get parent's parent properties first (grandparent)
+            Map<String, String> grandparentProperties = parseParentPomProperties(
+                parentDoc, parentPath.toString(), factory, builder);
+            if (!grandparentProperties.isEmpty()) {
+                parentProperties.putAll(grandparentProperties);
+            }
+
+            // Then get parent's own properties (these override grandparent)
+            Map<String, String> parentOwnProperties = parseProperties(parentDoc);
+            parentProperties.putAll(parentOwnProperties);
+
+        } catch (Exception e) {
+            logger.warn("Error parsing parent POM: {}", e.getMessage());
+        }
+
+        return parentProperties;
+    }
+
     /**
      * Resolve a property reference like ${spring.version} using the properties map
      * Supports nested properties (properties that reference other properties)