[MNG-7906] Dependency Management import (BOM) does not work the "maven way"

**[Tamas Cservenak](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=cstamas)** opened **[MNG-7906](https://issues.apache.org/jira/browse/MNG-7906?redirect=false)** and commented

This affects all released Maven versions so far (precisely since 2.0.9 MNG-3220).

Problem reproducer: https://github.com/cstamas/MNG-7852 (repo name is wrong, obviously).

In short: unlike with dependencies, where you CAN override some "deep transitive" dependency by re-declaring it directly as 1st level dependency in POM, for depMgt import this does not work, actually, it works quite the opposite ("first comes, wins"). Moreover, Maven remains silent about this, as reproducer shows, and all of this goes unnoticed.

Solution: at least depMgt import should make "the maven way", maybe not by default (to not break existing builds) but configurable. Problem is solved if in reproducer:
- with fix enabled, junit 5.9.3 is used, AND
- with fix disabled, Maven yells about ignored depMgt import

---

**Issue Links:**
- [MNG-3220](https://issues.apache.org/jira/browse/MNG-3220) Allow managed dependencies to be imported into other projects
(_**"is caused by"**_)
- [MPH-183](https://issues.apache.org/jira/browse/MPH-183) Effective-pom + verbose should show import path to BOM dependencyManagement

- [MNG-7344](https://issues.apache.org/jira/browse/MNG-7344) Effective pom should contain more finegrained details regarding its content origin: track dependencyManagement import

- [MNG-7854](https://issues.apache.org/jira/browse/MNG-7854) Non directly managed imported and conflicting depMgt entries should warn

**Remote Links:**
- [GitHub Pull Request #1396
](https://github.com/apache/maven/pull/1396)

0 votes, 7 watchers