<version>0.2</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>test</groupId>
      <artifactId>c</artifactId>
      <version>0.2</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>test</groupId>
      <artifactId>d</artifactId>
      <version>0.2</version>
      <scope>test</scope>
    </dependency>
    <dependency>

            <scope>test</scope>
          </dependency>
          <dependency>
            <groupId>test</groupId>
            <artifactId>e</artifactId>
            <version>0.2</version>
            <scope>provided</scope>
          </dependency>
          <dependency>
            <groupId>test</groupId>
            <artifactId>f</artifactId>
            <version>0.2</version>
            <scope>import</scope>

  <version>0.1</version>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>test</groupId>
        <artifactId>a</artifactId>
        <version>0.1</version>
        <scope>import</scope>
        <type>pom</type>
        <classifier>cls</classifier>
      </dependency>
    </dependencies>
  </dependencyManagement>

        <version>0.2</version>
        <scope>compile</scope>
      </dependency>
      <dependency>
        <groupId>test</groupId>
        <artifactId>c</artifactId>
        <version>0.2</version>
        <scope>runtime</scope>
      </dependency>
      <dependency>
        <groupId>test</groupId>
        <artifactId>d</artifactId>
        <version>0.2</version>
        <scope>test</scope>
      </dependency>

  <version>0.1</version>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>test</groupId>
        <artifactId>a</artifactId>
        <version>0.1</version>
        <scope>import</scope>
        <!-- missing type=pom -->
      </dependency>
    </dependencies>
  </dependencyManagement>

The *path operation* itself also declares a scope, `"items"`, so this will also be in the list of `security_scopes.scopes` passed to `get_current_user`.

Here's how the hierarchy of dependencies and scopes looks like:

    </dependency>

    <dependency>
      <groupId>maven-test</groupId>
      <artifactId>scope-compile</artifactId>
      <version>1.0</version>
      <scope>compile</scope>
    </dependency>

    <dependency>
      <groupId>maven-test</groupId>
      <artifactId>scope-provided</artifactId>
      <version>1.0</version>
      <scope>provided</scope>
    </dependency>

    <dependency>

        artifact = getArtifact(project, "maven-test-test", "scope-default");
        assertEquals("test", artifact.getScope(), "Check scope");
        artifact = getArtifact(project, "maven-test-test", "scope-runtime");
        assertEquals("test", artifact.getScope(), "Check scope");

        // check all transitive deps of a provided dependency are provided scope, except for test

import org.eclipse.aether.impl.scope.CommonBuilds;
import org.eclipse.aether.impl.scope.InternalScopeManager;
import org.eclipse.aether.impl.scope.ScopeManagerConfiguration;
import org.eclipse.aether.internal.impl.scope.ScopeManagerDump;

import static org.eclipse.aether.impl.scope.BuildScopeQuery.all;
import static org.eclipse.aether.impl.scope.BuildScopeQuery.byBuildPath;
import static org.eclipse.aether.impl.scope.BuildScopeQuery.byProjectPath;

            String type,
            String classifier,
            String scope,
            String inheritedScope,
            boolean optional) {
        String desiredScope = Artifact.SCOPE_RUNTIME;

        if (inheritedScope == null) {
            desiredScope = scope;
        } else if (Artifact.SCOPE_TEST.equals(scope) || Artifact.SCOPE_PROVIDED.equals(scope)) {
            return null;