[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

Maven throws on a collection error before it fetches any artifact. So one dependency whose POM or version range failed left every other dependency of the module without its jar, and reachability called their vulnerabilities unreachable.

• The facts extension runs the artifact step itself on the partial graph, leaving the failed dependencies out (as the resolver's own resolveDependencies does).
• A jar that cannot be fetched is reported under its full coordinate and marked unfetched.
• Maven 4's batched failures are unwrapped to their real cause.

Testing: graph-failure compat suite extended with a --with-files run; passes on Maven 3.2.5, 3.6.3, 3.8.8, 3.9.9 and 4.0.0-rc-6.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes Maven reachability/facts resolution when dependencies fail partially; incorrect materialization could mis-attribute jar paths or failure reporting, but scope is limited to the facts extension and is covered by compat tests.

Overview
Fixes Maven Socket facts generation when the dependency graph is only partially resolvable—especially with --with-files for reachability.

If Maven hits a collection error, it used to skip artifact download for every dependency in that module, so healthy jars never got file records and reachability treated their CVEs as unreachable. The extension now runs Aether resolveDependencies on the partial graph (excluding known-bad nodes), materializing jars for dependencies that still resolve.

Jars that cannot be fetched are reported under their full coordinate with a failure row and an unfetched marker on the node; rootMessage also unwraps Maven 4 batch errors so the real cause is shown instead of a generic wrapper. The graph-failure compat test adds a nojar fixture and asserts --with-files behavior.

^{Reviewed by Cursor Bugbot for commit 2e5273e. Configure here.}

[Martin Torp (mtorp)]

[agent] Approving. I didn't find issues in this one. The graph is already conflict-resolved and each node carries its own repositories, so running the artifact step on it lines up with what Maven itself would do.