diff --git a/pkg/lockfile/parse-maven-lock.go b/pkg/lockfile/parse-maven-lock.go index 6491b25e..671a53f9 100644 --- a/pkg/lockfile/parse-maven-lock.go +++ b/pkg/lockfile/parse-maven-lock.go @@ -115,7 +115,7 @@ func ParseMavenLock(pathToLockfile string) ([]PackageDetails, error) { details := map[string]PackageDetails{} - for _, lockPackage := range parsedLockfile.Dependencies { + for _, lockPackage := range parsedLockfile.ManagedDependencies { finalName := lockPackage.GroupID + ":" + lockPackage.ArtifactID details[finalName] = PackageDetails{ @@ -126,8 +126,8 @@ func ParseMavenLock(pathToLockfile string) ([]PackageDetails, error) { } } - // managed dependencies take precedent over standard dependencies - for _, lockPackage := range parsedLockfile.ManagedDependencies { + // standard dependencies take precedent over managed dependencies + for _, lockPackage := range parsedLockfile.Dependencies { finalName := lockPackage.GroupID + ":" + lockPackage.ArtifactID details[finalName] = PackageDetails{ diff --git a/pkg/lockfile/parse-maven-lock_test.go b/pkg/lockfile/parse-maven-lock_test.go index d7ef4c87..da8f05c1 100644 --- a/pkg/lockfile/parse-maven-lock_test.go +++ b/pkg/lockfile/parse-maven-lock_test.go @@ -101,7 +101,7 @@ func TestParseMavenLock_WithDependencyManagement(t *testing.T) { expectPackages(t, packages, []lockfile.PackageDetails{ { Name: "io.netty:netty-all", - Version: "4.1.42.Final", + Version: "4.1.9", Ecosystem: lockfile.MavenEcosystem, CompareAs: lockfile.MavenEcosystem, },