BOM packaging expanding wrong / Flatten the content

[khmarbaise]

Affected version

Maven 4.0.0-rc6

Bug description

Reproducer Git Repo: https://github.com/khmarbaise/maven-bug-4.0.0-rc6-bom

The root pom of the project defines some parts in dependency management like this:

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.junit</groupId>
        <artifactId>junit-bom</artifactId>
        <version>${version.junit-bom}</version>
        <scope>import</scope>
        <type>pom</type>
      </dependency>
      <dependency>
        <groupId>org.assertj</groupId>
        <artifactId>assertj-bom</artifactId>
        <version>3.27.7</version>
        <scope>import</scope>
        <type>pom</type>
      </dependency>
    </dependencies>
  </dependencyManagement>

The intresting module bom which is of type packaging bom contains the following:

  <dependencyManagement>
    <dependencies>
      <dependency>
          <groupId>com.soebes.examples.maven4</groupId>
          <artifactId>mod-1</artifactId>
      </dependency>
      <dependency>
          <groupId>com.soebes.examples.maven4</groupId>
          <artifactId>mod-2</artifactId>
      </dependency>
    </dependencies>
  </dependencyManagement>

What I expected to have is that the resulting BOM file contains only the resolved versions for the given modules in it...like this:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.soebes.examples.maven4</groupId>
  <artifactId>bom</artifactId>
  <version>1.0.0-1</version>
  <packaging>pom</packaging>
  <name>Maven 4 :: BOM :: MOD BOM</name>
  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>com.soebes.examples.maven4</groupId>
        <artifactId>mod-1</artifactId>
        <version>1.0.0-1</version>
      </dependency>
      <dependency>
        <groupId>com.soebes.examples.maven4</groupId>
        <artifactId>mod-2</artifactId>
        <version>1.0.0-1</version>
      </dependency>
    </dependencies>
  </dependencyManagement>
</project>

but what I get is:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.soebes.examples.maven4</groupId>
  <artifactId>bom</artifactId>
  <version>1.0.0-1</version>
  <packaging>pom</packaging>
  <name>Maven 4 :: BOM :: MOD BOM</name>
  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>com.soebes.examples.maven4</groupId>
        <artifactId>mod-1</artifactId>
        <version>1.0.0-1</version>
      </dependency>
      <dependency>
        <groupId>com.soebes.examples.maven4</groupId>
        <artifactId>mod-2</artifactId>
        <version>1.0.0-1</version>
      </dependency>
      <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter</artifactId>
        <version>6.1.1</version>
      </dependency>
      <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter-api</artifactId>
        <version>6.1.1</version>
      </dependency>
      <dependency>
....
      <dependency>
        <groupId>org.assertj</groupId>
        <artifactId>assertj-core</artifactId>
        <version>3.27.7</version>
      </dependency>
      <dependency>
        <groupId>org.assertj</groupId>
        <artifactId>assertj-guava</artifactId>
        <version>3.27.7</version>
      </dependency>

The first two entries are the defined modules within the multiproject build which is fine, but parts which are following are not. They are inheriting from the parent and flatten with all dependencies which are from the dependencyManagement of the parent and their boms.

That gives me no control what exactly will be in the resulting BOM-file. Furthermore why is the BOM file (in this case junit-bom and assertj-bom) flattened and not kept as it in the resulting BOM?

If I want to have the junit-bom in my bom-module being put into.. I could add a reference like this:

  <dependencyManagement>
    <dependencies>
      <dependency>
          <groupId>com.soebes.examples.maven4</groupId>
          <artifactId>mod-1</artifactId>
      </dependency>
      <dependency>
          <groupId>com.soebes.examples.maven4</groupId>
          <artifactId>mod-2</artifactId>
      </dependency>
      <dependency>
        <groupId>org.junit</groupId>
        <artifactId>junit-bom</artifactId>
        <version>${version.junit-bom}</version>
        <scope>import</scope>
        <type>pom</type>
      </dependency>
    </dependencies>
  </dependencyManagement>

But as before it will be flattened which is from my perspective not a good idea.