[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

When JVM dependency resolution failed under --dynamic-sbom-inference, the CLI told users to re-run with flags the command silently ignores, suggested excluding a graph configuration that does not exist, and named the user's own module instead of the dependency that broke. This makes the report accurate and the remedies actionable, and makes Maven, Gradle and sbt report failures the same way.

Reporting

• Failures name the dependency that failed, the subproject that needed it, and its configuration/scope where the build tool's graph has one. A failure the graph cannot place has no configuration, so excluding configurations is not offered as a fix for it.
• Maven: a dependency whose POM cannot be fetched while building the graph is reported under its own scope (was: the module itself under a made-up graph configuration). Excluding that scope now clears it.
• Remedies name only what the invoking command accepts: flags for socket manifest <tool>, --ignore-unresolved (new) for socket manifest dynamic-sbom-inference, and the failing build's own socket.json plus its setup wizard for scan, fix and auto-manifest.
• socket scan create and socket scan reach warn about --ignore-unresolved, --exclude-configs, --include-configs and --verbose, which they read from socket.json.
• verbose in socket.json is honored on the dynamic-sbom-inference path, and a build tool that cannot start says why (e.g. spawn mvn ENOENT).

Facts output

• Unresolved dependencies are reported and left out of the facts for all three tools. Maven used to emit them without children; Gradle and sbt already left them out.
• sbt: a failed update now retries leniently (missingOk) instead of excluding the named modules. Previously, when Coursier named a missing parent POM, the exclusion retry failed too and the whole project was silently emitted empty.

Where the tools don't give us more

• sbt 1.3+ (Coursier) names a missing parent POM rather than the dependency that declares it, so that dependency stays in the facts; Ivy (sbt 0.13) names the dependency.
• Maven 3.2's resolver drops a dependency whose POM failed from the graph, so it gets no scope there.
• A jar that fails to download under --with-files is still reported by Maven but only logged by Gradle; aligning that would add new blocking failures for Gradle users.

Testing

• New compat fixtures: maven-compat/smoke-test-graph-failure.sh (scopes, excluded scope, failed nodes not emitted) and sbt-compat/smoke-test-failure.sh (project survives, failures not emitted). Maven matrix 3.2.5 to 4.0.0-rc-6 and sbt 0.13.18 to 1.9.9 pass.
• run-compat.sh now puts each row's JDK on PATH: the sbt launcher ignores JAVA_HOME, so sbt rows ran on whatever JDK was first on PATH.
• Unit tests for the renderer remedies and the recursive generator. Full unit suite passes apart from the socket json tests (also failing on v1.x) and two socket fix tests that need network access.

---

Note

Medium Risk
Changes how unresolved JVM dependencies affect facts SBOM output and exit behavior across Maven, Gradle, and sbt; incorrect handling could under-report dependencies in scans, but changes are targeted at error reporting and fail-closed semantics with added tests.

Overview
Improves JVM manifest / dynamic SBOM inference when dependencies fail to resolve: errors name the failing coordinate, subproject, and scope where applicable, and remediation text only suggests options the command you ran actually supports (CLI flags vs each build's socket.json).

CLI behavior

• Adds --ignore-unresolved to socket manifest dynamic-sbom-inference (overrides per-root socket.json).
• Dynamic SBOM inference honors per-build verbose from cascaded socket.json and passes build-option hints so resolution errors point at the failing root's socket.json and socket manifest setup --dynamic-sbom-inference.
• socket scan create / socket scan reach warn when users pass --ignore-unresolved, config filters, or --verbose (those are read from socket.json only).
• Spawn failures for Maven/Gradle/sbt always include the underlying reason (e.g. missing mvn).

Facts pipeline (Maven, Gradle, sbt)

• Failure/unscannable records carry a project field; unresolved deps are reported and omitted from emitted facts consistently.
• Maven stops inventing module-level graph failures and attributes collection errors to the artifact and scopes in the graph.
• sbt retries updates with missingOk instead of excluding failed modules, so resolved deps are kept when one dependency breaks.

Tests

• New Maven/sbt compat smoke tests for graph-level failures and partial resolution; updated assertion scripts for the new record shape.

^{Reviewed by Cursor Bugbot for commit faa3bcc. Configure here.}

[Martin Torp (mtorp)]

[agent] Reviewed 4943bad19d37. All 36 focused tests passed, and the live Maven and sbt failure fixtures passed. The two numbered inline comments cover the remaining JSON output and sbt diagnostic-size issues.