Feature request: maven dependency tree

Hello!
Apologies if this isn't the best forum for feature requests, but wanted thoughts/opinions on adding an analog to mvn dependency:tree as a rule.

I believe this should be possible via the maven_coordinates tag that gets added to each dependency and think I see path forward looking at the code in pom_file.bzl.

We are scanning maven dependencies for vulnerabilities with Snyk, but sometimes it's difficult to determine what maven artifact is providing the transitive dependency on an out-of-date library. Currently the easiest approach is to run the java_export rule and create a POM file, then run mvn dependency:tree on that pom file to visually see the Maven artifact versions and dependencies.

Would it be possible to add a pure Starlark rule that creates and output similar to mvn dependency:tree that includes the maven coordinates and versions? I'm happy to take a stab at something too if you feel it is worthwhile. Thanks!

Start by reading pom_file.bzl and tracing how the maven_coordinates tag is added to dependencies and how java_export produces a POM file. Compare the available metadata with mvn dependency:tree, then define a pure Starlark rule whose output shows Maven coordinates, versions, and transitive relationships.