Resolve Maven properties in component coordinates

[Aayush Maini (AMaini503)]

Summary

Resolve Maven property references in every component coordinate field when the static POM parser is used.

• interpolate properties in groupId, artifactId, and version
• recursively resolve nested local and inherited properties with cycle detection
• support embedded references such as spark-core_${scala.version.major}
• skip components whose coordinates remain unresolved
• bump the Maven detector version from 5 to 6

Testing

• dotnet build --no-restore --configuration Debug
• dotnet test test\Microsoft.ComponentDetection.Detectors.Tests\Microsoft.ComponentDetection.Detectors.Tests.csproj --no-build --configuration Debug -p:ExcludeIntegrationTests=false -p:TestingPlatformCommandLineArguments="--filter FullyQualifiedName~MvnCliDetectorTests"

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂

[Copilot]

Copilot review overview

🟡 Changes recommended

Single-pass interpolation incorrectly skips valid components containing nested property references.

Review effort: Balanced
Findings: 1

Open (1)

• Resolve nested Maven property references before component resolution · New

What changed in this PR

Extends Maven static parsing to interpolate properties across dependency coordinates.

Changes:

• Resolves local and inherited coordinate properties.
• Skips unresolved coordinates.
• Adds tests and bumps detector version to 6.

File	Description
MvnCliComponentDetector.cs	Expands coordinate properties and defers unresolved components.
PendingComponent.cs	Renames coordinate fields as templates.
MvnCliDetectorTests.cs	Tests interpolation, inheritance, and unresolved coordinates.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unbounded recursive property expansion can terminate scans through stack exhaustion.

Review effort: Balanced
Findings: 1

Open (1)

• Prevent stack overflow from deeply nested property expansion · New

Resolved since last review (1)

• Resolve nested Maven property references before component resolution

[Copilot]

Copilot review overview

🔵 Needs a closer look

The unresolved-reference check can register malformed Maven placeholders as valid components.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Prevent stack overflow from deeply nested property expansion

Previously missed (1)

In code that hasn't changed since last review

Unresolved Maven placeholders are incorrectly registered as components

src/​Microsoft.ComponentDetection.Detectors/​maven/​MvnCliComponentDetector.cs:284

This check misses unresolved forms such as ${} and ${missing because the resolution regex requires a nonempty, closed expression. Those versions were previously deferred by StartsWith("${") and skipped, but are now registered as Maven components with literal placeholder text. Use a broader residual-marker check after expansion so any remaining Maven interpolation start causes the coordinate to be skipped.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation safely handles the documented resolution cases and includes focused regression coverage.

Review effort: Balanced
Findings: None