<version>0.1</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.junit</groupId>
                <artifactId>junit</artifactId>
                <version>0.1</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

 * the graph we construct has a single root ( the subproject ) and all dependencies are children of that root,
 * irrespective of if they are direct dependencies or transitive ones ( that should be children of other children ).
 * Although we end up lacking some contextual information, this allows us to scan and monitor only the dependencies
 * that are bundled and used in runtime.
 */

    <modelVersion>4.0.0</modelVersion>

    <groupId>test</groupId>
    <artifactId>test</artifactId>
    <version>0.1-SNAPSHOT</version>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>test</groupId>
                <artifactId>import</artifactId>
                <version>0.1-SNAPSHOT</version>
                <type>pom</type>

              <goal>build-bom</goal>
            </goals>
            <configuration>
              <bomClassifier>fat</bomClassifier>
              <bomName>Maven Dependencies Fat BOM</bomName>
              <bomDescription>Bill Of Materials for Apache Maven - All dependencies</bomDescription>
              <outputFilename>maven-fat-bom.xml</outputFilename>
              <reactorDependencies>REACTOR</reactorDependencies>

        // Dependencies
        // ----------------------------------------------------------------------

        List<?> dependencies = (List) ReflectionValueExtractor.evaluate("project.dependencies", project);

        assertNotNull(dependencies);

        assertEquals(2, dependencies.size());

    <modelVersion>4.0.0</modelVersion>

    <groupId>test</groupId>
    <artifactId>test</artifactId>
    <version>0.1-SNAPSHOT</version>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>test</groupId>
                <artifactId>other</artifactId>
                <version>0.1-SNAPSHOT</version>
                <type>pom</type>

                // It should have never found its way into Maven 2.x repository, but it did.
                dependencies = Collections.emptyList();
            } else {
                dependencies = rel.project.getModel().getDependencies();

                DependencyManagement depMgmt = rel.project.getModel().getDependencyManagement();

                .artifactId("artifactId")
                .type("type")
                .build();

        Model target =
                Model.newBuilder().dependencies(Arrays.asList(dependency)).build();

        Model source =
                Model.newBuilder().dependencies(Arrays.asList(dependency)).build();

        Model merged = mavenMerger.merge(target, source, true, null);

plugins {
    `java-platform`
}

group = "gradlebuild"

description = "Provides a platform that constrains versions of external dependencies used by Gradle"

// To try out newer kotlin versions
val kotlinVersion = providers.gradleProperty("buildKotlinVersion")
    .getOrElse(embeddedKotlinVersion)

dependencies {
    constraints {
        val distributionDependencies = versionCatalogs.named("buildLibs")

    <version>0.1-SNAPSHOT</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>test</groupId>
                <artifactId>mydep</artifactId>
                <version>0.1</version>
            </dependency>
        </dependencies>
    </dependencyManagement>