From cc4b0bed62ed50d18deaf3d1a83d150e849a78a1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 28 Oct 2026 15:34:19 +0000
Subject: [PATCH 1/5] Start fix for #513, #459

Assisted-by: Claude Code:claude-opus-5-5

From 253ab73747abc04ac9fb322cbfa9c92b94a18310 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 28 Oct 2026 15:45:00 +0000
Subject: [PATCH 2/5] Test Maven reactor pins on uncertain properties

A reactor module whose version is an undefined ${prop} or one a
profile raises still got a root pin and a rewrite, so the build kept
an unpatched jar while vex attested not_affected. These tests capture
#513 (external-parent property, Maven 4 <parent/> inference) and
#459 (profile overrides) and fail on main.

Assisted-by: Claude Code:claude-opus-5-5
---
 .../socket-patch-cli/tests/vendor_jvm_cli.rs  |  47 ++++
 .../src/vendor/jvm/maven_reactor.rs           | 203 +++++++++++++++++-
 2 files changed, 246 insertions(+), 4 deletions(-)

diff --git a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
index bd75dd126..45ea33920 100644
--- a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
+++ b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
@@ -1153,6 +1153,53 @@ fn gradle_vendor_533_unpatched_classifier_copy_withholds_vex() {
     assert!(!vex.exists(), "{env}");
 }
 
+/// #513 / #459: a reactor `${prop}` version that can't be pinned with
+/// certainty (undefined in the checkout, or raised by a profile) is left
+/// as is with a warning, and `vex` does not attest the package the build
+/// still takes unpatched.
+#[test]
+fn maven_reactor_uncertain_property_version_withholds_vex() {
+    for (extra, reason) in [
+        ("", "property_unresolved"),
+        (
+            "<properties><foo.version>1.0</foo.version></properties>\
+             <profiles><profile><id>new</id><properties><foo.version>1.1</foo.version>\
+             </properties></profile></profiles>",
+            "conflicting_literal_version",
+        ),
+    ] {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        fixture(root, Shape::Reactor, &[("foo", FOO_UUID)]);
+        let a = std::fs::read_to_string(root.join("proj/a/pom.xml")).unwrap();
+        let a = a
+            .replace(
+                "<version>1.0</version></dependency>",
+                "<version>${foo.version}</version></dependency>",
+            )
+            .replace(
+                "<artifactId>a</artifactId>",
+                &format!("<artifactId>a</artifactId>{extra}"),
+            );
+        write(root, "proj/a/pom.xml", a.as_bytes());
+        let env = ok(root, &["vendor"]);
+        assert!(env.to_string().contains(&format!("reason: {reason}")), "{env}");
+        assert_eq!(std::fs::read_to_string(root.join("proj/a/pom.xml")).unwrap(), a);
+        assert!(!wiring_text(root).contains("-socket."), "{reason}: pinned");
+        let vex = root.join("vex.json");
+        let (_, env) = socket(
+            root,
+            &["vex", "-O", vex.to_str().unwrap(), "--product", "pkg:generic/x@1"],
+        );
+        assert_eq!(
+            events(&env),
+            [(purl("foo"), "skipped".to_string(), "vendor_unwired".to_string())],
+            "{reason}: {env}"
+        );
+        assert!(!vex.exists(), "{env}");
+    }
+}
+
 /// #429 repair: a deleted owned `.gitattributes` (and nothing else) is
 /// rewritten by `repair` (no download), so the next autocrlf clone keeps the
 /// script and index LF.
diff --git a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
index c8c54f681..783bfe19a 100644
--- a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
@@ -4043,10 +4043,8 @@ mod tests {
             plan.warnings[0].detail
         );
         assert_eq!(text(&after, "a/pom.xml"), a);
-        assert!(
-            text(&after, "pom.xml").contains("<dependencyManagement>"),
-            "still pinned"
-        );
+        // a's explicit `${remote.prop}` beats any pin (#513).
+        assert!(!text(&after, "pom.xml").contains("<dependencyManagement>"));
     }
 
     #[test]
@@ -5141,6 +5139,203 @@ mod tests {
         assert!(text(&after, "pom.xml").contains(&format!("<version>{SV}</version></dependency>")));
     }
 
+    // ── uncertain property versions (#513, #459) ──
+
+    /// No pom of the reactor names the suffixed version: `vex` sees the
+    /// patch as unwired.
+    fn unwired(files: &Fs) -> bool {
+        files
+            .iter()
+            .filter(|(rel, _)| rel.ends_with(".xml"))
+            .all(|(_, bytes)| !String::from_utf8_lossy(bytes).contains(SV))
+    }
+
+    /// `profile` as a profile of `pom`, placed before its `<dependencies>`
+    /// (or `<modules>`).
+    fn with_profile(pom: &str, id: &str, props: &str) -> String {
+        let profile = format!(
+            "<profiles><profile><id>{id}</id><activation><activeByDefault>true\
+             </activeByDefault></activation><properties>{props}</properties></profile>\
+             </profiles>\n  "
+        );
+        let at = pom
+            .find("<dependencies>")
+            .or_else(|| pom.find("<modules>"))
+            .unwrap();
+        format!("{}{profile}{}", &pom[..at], &pom[at..])
+    }
+
+    /// #513 case 1: a property only an external parent defines keeps the
+    /// module's explicit version over any pin, so the root is not pinned.
+    #[test]
+    fn a_property_from_an_external_parent_leaves_the_root_unpinned() {
+        let parent = "<parent><groupId>com.corp</groupId><artifactId>corp-parent</artifactId>\
+            <version>3</version><relativePath/></parent>";
+        let mut files = external_reactor(parent, "");
+        let a = text(&files, "a/pom.xml").replace(
+            "</artifactId></dependency>",
+            "</artifactId><version>${ct.version}</version></dependency>",
+        );
+        files.insert("a/pom.xml".into(), a.clone().into_bytes());
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["property_unresolved"]);
+        let after = applied(&files, &plan);
+        assert_eq!(text(&after, "a/pom.xml"), a);
+        assert!(!root_pinned(&plan, &files));
+        assert!(unwired(&after));
+    }
+
+    /// #513 case 2: Maven 4.1.0 infers an empty `<parent/>` from
+    /// `../pom.xml`, so the root's property resolves and is rewritten.
+    #[test]
+    fn a_maven_4_inferred_parent_is_local() {
+        let root = "<project xmlns=\"http://maven.apache.org/POM/4.1.0\">\n  \
+            <modelVersion>4.1.0</modelVersion>\n  <groupId>com.example</groupId>\n  \
+            <artifactId>root</artifactId>\n  <version>1.0.0</version>\n  \
+            <packaging>pom</packaging>\n  <subprojects><subproject>a</subproject></subprojects>\n  \
+            <properties><ct.version>1.10.0</ct.version></properties>\n</project>\n";
+        let a = format!(
+            "<project xmlns=\"http://maven.apache.org/POM/4.1.0\">\n  \
+             <modelVersion>4.1.0</modelVersion>\n  <parent/>\n  <artifactId>a</artifactId>\n  \
+             <dependencies>\n    {}\n  </dependencies>\n</project>\n",
+            dep("${ct.version}")
+        );
+        let files = fs(&[("pom.xml", root), ("a/pom.xml", &a)]);
+        let (plan, after) = vendor(&files);
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert_eq!(text(&after, "a/pom.xml"), a.replace("${ct.version}", SV));
+        assert!(root_pinned(&plan, &files));
+    }
+
+    /// #459: a profile of the declaring module raising the property keeps
+    /// the declaration and leaves the root unpinned.
+    #[test]
+    fn a_profile_overriding_the_version_property_is_left_alone() {
+        let root = ROOT.replace(
+            "  <modules>",
+            "  <properties><ct.version>1.10.0</ct.version></properties>\n  <modules>",
+        );
+        let a = with_profile(
+            &module("a", &dep("${ct.version}")),
+            "modern-jdk",
+            "<ct.version>1.11.0</ct.version>",
+        );
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["conflicting_literal_version"]);
+        assert!(
+            plan.warnings[0].detail.contains("profile modern-jdk"),
+            "{:?}",
+            plan.warnings
+        );
+        let after = applied(&files, &plan);
+        assert_eq!(text(&after, "a/pom.xml"), a);
+        assert!(!root_pinned(&plan, &files));
+        assert!(unwired(&after));
+    }
+
+    /// #459: the same through the parent's profile, and through a profile
+    /// overriding a property the version is built from.
+    #[test]
+    fn a_profile_up_the_chain_or_on_a_nested_property_is_weighed() {
+        let a = module("a", &dep("${ct.version}"));
+        for (props, profile) in [
+            (
+                "<ct.version>1.10.0</ct.version>",
+                "<ct.version>1.11.0</ct.version>",
+            ),
+            (
+                "<ct.minor>10</ct.minor><ct.version>1.${ct.minor}.0</ct.version>",
+                "<ct.minor>11</ct.minor>",
+            ),
+        ] {
+            let root = with_profile(
+                &ROOT.replace(
+                    "  <modules>",
+                    &format!("  <properties>{props}</properties>\n  <modules>"),
+                ),
+                "corp",
+                profile,
+            );
+            let files = fs(&[
+                ("pom.xml", &root),
+                ("a/pom.xml", &a),
+                ("b/pom.xml", &module("b", "")),
+            ]);
+            let plan = run(&files).unwrap();
+            assert_eq!(reasons(&plan), ["conflicting_literal_version"], "{props}");
+            let after = applied(&files, &plan);
+            assert_eq!(text(&after, "a/pom.xml"), a);
+            assert!(unwired(&after), "{props}");
+        }
+    }
+
+    /// #459: a module's profile overriding the property an inherited
+    /// management declaration reads keeps that declaration.
+    #[test]
+    fn an_inheriting_modules_profile_keeps_the_managed_property() {
+        let root = ROOT.replace(
+            "  <build>",
+            "  <properties><ct.version>1.10.0</ct.version></properties>\n  \
+             <dependencyManagement>\n    <dependencies>\n      \
+             <dependency><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId>\
+             <version>${ct.version}</version></dependency>\n    </dependencies>\n  \
+             </dependencyManagement>\n  <build>",
+        );
+        let bare = "<dependency><groupId>org.apache.commons</groupId>\
+                    <artifactId>commons-text</artifactId></dependency>";
+        let a = with_profile(
+            &module("a", bare),
+            "new",
+            "<ct.version>1.12.0</ct.version>",
+        );
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", bare)),
+        ]);
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["conflicting_literal_version"]);
+        assert!(unwired(&applied(&files, &plan)));
+    }
+
+    /// A profile that sets the base version (or a user property that wins
+    /// over every profile) changes nothing.
+    #[test]
+    fn a_profile_agreeing_with_the_base_or_beaten_by_maven_config_is_rewritten() {
+        let root = ROOT.replace(
+            "  <modules>",
+            "  <properties><ct.version>1.10.0</ct.version></properties>\n  <modules>",
+        );
+        let agreeing = with_profile(
+            &module("a", &dep("${ct.version}")),
+            "same",
+            "<ct.version>1.10.0</ct.version>",
+        );
+        let raising = with_profile(
+            &module("a", &dep("${ct.version}")),
+            "new",
+            "<ct.version>1.11.0</ct.version>",
+        );
+        for (a, config) in [(&agreeing, None), (&raising, Some("-Dct.version=1.10.0\n"))] {
+            let mut files = fs(&[
+                ("pom.xml", &root),
+                ("a/pom.xml", a),
+                ("b/pom.xml", &module("b", "")),
+            ]);
+            if let Some(config) = config {
+                files.insert(".mvn/maven.config".into(), config.as_bytes().to_vec());
+            }
+            let (plan, after) = vendor(&files);
+            assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+            assert_eq!(text(&after, "a/pom.xml"), a.replace("${ct.version}", SV));
+        }
+    }
+
     #[test]
     fn plugin_configuration_modules_do_not_make_a_reactor() {
         let ear = "<project><modelVersion>4.0.0</modelVersion><groupId>t</groupId>\

From cd2f751a0082e42847a508b1f28098cb7721c9b1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 28 Oct 2026 15:47:16 +0000
Subject: [PATCH 3/5] Leave Maven roots unpinned on uncertain properties

The vendored Maven reactor planner pinned and rewrote a ${prop}
version it could not resolve with certainty, so the build kept
Central's unpatched jar while vendor reported applied and vex attested
not_affected.

- An undefined property now leaves the local root unpinned, like a
  conflicting literal: the module's explicit version beats any pin.
- Profile <properties> are read. A version a profile on the chain of
  the declaring pom (or of a pom inheriting it) would move off the
  base is left as is with conflicting_literal_version, and the root
  is not pinned. maven.config user properties still win.
- A Maven 4 <parent/> without coordinates resolves to ../pom.xml, so
  a property defined in the checkout's root is found and patched.

Fixes #513, #459.

Assisted-by: Claude Code:claude-opus-5-5
---
 .../socket-patch-cli/tests/vendor_jvm_cli.rs  |  24 +++-
 .../src/vendor/jvm/maven_reactor.rs           | 120 +++++++++++++++---
 2 files changed, 124 insertions(+), 20 deletions(-)

diff --git a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
index 45ea33920..17b8ec7af 100644
--- a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
+++ b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
@@ -1183,17 +1183,33 @@ fn maven_reactor_uncertain_property_version_withholds_vex() {
             );
         write(root, "proj/a/pom.xml", a.as_bytes());
         let env = ok(root, &["vendor"]);
-        assert!(env.to_string().contains(&format!("reason: {reason}")), "{env}");
-        assert_eq!(std::fs::read_to_string(root.join("proj/a/pom.xml")).unwrap(), a);
+        assert!(
+            env.to_string().contains(&format!("reason: {reason}")),
+            "{env}"
+        );
+        assert_eq!(
+            std::fs::read_to_string(root.join("proj/a/pom.xml")).unwrap(),
+            a
+        );
         assert!(!wiring_text(root).contains("-socket."), "{reason}: pinned");
         let vex = root.join("vex.json");
         let (_, env) = socket(
             root,
-            &["vex", "-O", vex.to_str().unwrap(), "--product", "pkg:generic/x@1"],
+            &[
+                "vex",
+                "-O",
+                vex.to_str().unwrap(),
+                "--product",
+                "pkg:generic/x@1",
+            ],
         );
         assert_eq!(
             events(&env),
-            [(purl("foo"), "skipped".to_string(), "vendor_unwired".to_string())],
+            [(
+                purl("foo"),
+                "skipped".to_string(),
+                "vendor_unwired".to_string()
+            )],
             "{reason}: {env}"
         );
         assert!(!vex.exists(), "{env}");
diff --git a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
index 783bfe19a..115e10695 100644
--- a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
@@ -1311,8 +1311,13 @@ struct Pom {
     parent: Option<ParentRef>,
     /// Top-level `<properties>` (profiles excluded).
     props: BTreeMap<String, String>,
+    /// Each profile's id and `<properties>`, in document order.
+    profile_props: Vec<(String, BTreeMap<String, String>)>,
 }
 
+/// A pom and one of its profiles' `<properties>`.
+type Overlay<'a> = (&'a str, &'a BTreeMap<String, String>);
+
 struct ParentRef {
     group: Option<String>,
     artifact: Option<String>,
@@ -1335,12 +1340,26 @@ impl Pom {
             version: doc.child_text(p, "version"),
             relative_path: doc.child(p, "relativePath").map(|r| doc.text_of(r)),
         });
-        let mut props = BTreeMap::new();
-        if let Some(p) = doc.child(project, "properties") {
-            for &c in &doc.nodes[p].children {
-                props.insert(doc.nodes[c].name.clone(), doc.text_of(c));
+        let properties_of = |model: usize| {
+            let mut props = BTreeMap::new();
+            if let Some(p) = doc.child(model, "properties") {
+                for &c in &doc.nodes[p].children {
+                    props.insert(doc.nodes[c].name.clone(), doc.text_of(c));
+                }
             }
-        }
+            props
+        };
+        let props = properties_of(project);
+        let profile_props = doc
+            .child(project, "profiles")
+            .into_iter()
+            .flat_map(|ps| doc.children(ps, "profile"))
+            .map(|p| {
+                let id = doc.child_text(p, "id").unwrap_or_else(|| "default".into());
+                (id, properties_of(p))
+            })
+            .filter(|(_, props)| !props.is_empty())
+            .collect();
         Ok(Pom {
             dir: rel.rsplit_once('/').map_or("", |(d, _)| d).to_string(),
             group: doc.child_text(project, "groupId"),
@@ -1351,6 +1370,7 @@ impl Pom {
                 .unwrap_or_else(|| "jar".to_string()),
             parent,
             props,
+            profile_props,
             doc,
         })
     }
@@ -1516,6 +1536,18 @@ impl Reactor {
     /// Interpolate every `${name}` in `value` in the context of `rel`;
     /// `None` when any name is undefined in the checkout.
     fn interpolate(&self, rel: &str, value: &str, depth: usize) -> Option<String> {
+        self.interpolate_with(rel, value, depth, None)
+    }
+
+    /// [`Self::interpolate`] with `overlay`'s properties (a profile's)
+    /// layered over its pom's own, as when that profile is active.
+    fn interpolate_with(
+        &self,
+        rel: &str,
+        value: &str,
+        depth: usize,
+        overlay: Option<Overlay<'_>>,
+    ) -> Option<String> {
         if depth > MAX_INTERPOLATION_DEPTH {
             return None;
         }
@@ -1525,8 +1557,8 @@ impl Reactor {
             out.push_str(&rest[..at]);
             let after = &rest[at + 2..];
             let close = after.find('}')?;
-            let raw = self.lookup(rel, &after[..close])?;
-            out.push_str(&self.interpolate(rel, &raw, depth + 1)?);
+            let raw = self.lookup_with(rel, &after[..close], overlay)?;
+            out.push_str(&self.interpolate_with(rel, &raw, depth + 1, overlay)?);
             rest = &after[close + 1..];
         }
         out.push_str(rest);
@@ -1537,6 +1569,10 @@ impl Reactor {
     /// model's own version expressions, then `<properties>` up the local
     /// chain.
     fn lookup(&self, rel: &str, name: &str) -> Option<String> {
+        self.lookup_with(rel, name, None)
+    }
+
+    fn lookup_with(&self, rel: &str, name: &str, overlay: Option<Overlay<'_>>) -> Option<String> {
         let pom = &self.poms[rel];
         match name {
             "project.version" | "pom.version" => {
@@ -1553,7 +1589,12 @@ impl Reactor {
         if let Some(v) = self.cli_props.get(name) {
             return Some(v.clone());
         }
-        if let Some(v) = self.chain(rel).find_map(|p| self.poms[p].props.get(name)) {
+        if let Some(v) = self.chain(rel).find_map(|p| {
+            overlay
+                .filter(|(at, _)| *at == p)
+                .and_then(|(_, props)| props.get(name))
+                .or_else(|| self.poms[p].props.get(name))
+        }) {
             return Some(v.clone());
         }
         (name == "version")
@@ -1561,6 +1602,31 @@ impl Reactor {
             .flatten()
     }
 
+    /// A version `declared` (with `${...}`) reaches in some pom that reads
+    /// it, `rel` or an inheritor, when a profile on that pom's chain is
+    /// active, and that is neither the base nor `sv`: the pom and the
+    /// profile's id, and the version. Profile activation is not evaluated,
+    /// so every profile counts.
+    fn profile_override(
+        &self,
+        rel: &str,
+        declared: &str,
+        base: &str,
+        sv: &str,
+    ) -> Option<(String, String, String)> {
+        std::iter::once(rel)
+            .chain(self.inheritors(rel))
+            .find_map(|reader| {
+                self.chain(reader).find_map(|at| {
+                    self.poms[at].profile_props.iter().find_map(|(id, props)| {
+                        let v = self.interpolate_with(reader, declared, 0, Some((at, props)))?;
+                        (!is_base_like(&v, base) && v != sv)
+                            .then(|| (format!("profile {id} of {at}"), v, reader.to_string()))
+                    })
+                })
+            })
+    }
+
     /// Every pom in scope that inherits from `rel` (has it on its chain).
     fn inheritors<'s>(&'s self, rel: &'s str) -> impl Iterator<Item = &'s str> + 's {
         self.scope
@@ -1643,9 +1709,11 @@ impl Reactor {
                             "property_unresolved",
                             format!(
                                 "{at}: {ga} version {declared} is not defined in the checkout; \
-                                 left as is, probably unpatched"
+                                 left as is, probably unpatched, and {root} is not pinned"
                             ),
                         ));
+                        // The explicit version beats any pin of the root.
+                        unpinned.insert(root);
                         continue;
                     }
                 }
@@ -1665,6 +1733,24 @@ impl Reactor {
                         (!is_base_like(&v, patch.version) && v != sv).then(|| (p.to_string(), v))
                     })
                 });
+                let profiled = || {
+                    declared
+                        .contains("${")
+                        .then(|| self.profile_override(rel, &declared, patch.version, sv))
+                        .flatten()
+                };
+                if let Some((profile, v, p)) = profiled() {
+                    warnings.push(degraded(
+                        "conflicting_literal_version",
+                        format!(
+                            "{at}: {ga} version {declared} resolves to {v} in {p} under \
+                             {profile}, not {}; left as is and {root} is not pinned",
+                            patch.version
+                        ),
+                    ));
+                    unpinned.insert(root);
+                    continue;
+                }
                 if let Some((p, v)) = overridden.flatten() {
                     warnings.push(degraded(
                         "conflicting_literal_version",
@@ -1910,8 +1996,14 @@ fn local_parent_of(
         (Some(a), Some(b)) => a == b,
         _ => true,
     };
-    let matches = want_group.as_deref() == candidate.effective_group()
-        && want_artifact == candidate.artifact
+    // Maven 4 (model 4.1.0) infers omitted parent coordinates from the
+    // pom at the relative path.
+    let matches = want_group
+        .as_deref()
+        .is_none_or(|g| Some(g) == candidate.effective_group())
+        && want_artifact
+            .as_deref()
+            .is_none_or(|a| Some(a) == candidate.artifact.as_deref())
         && versions_agree;
     Ok(matches.then_some(parent_rel))
 }
@@ -5288,11 +5380,7 @@ mod tests {
         );
         let bare = "<dependency><groupId>org.apache.commons</groupId>\
                     <artifactId>commons-text</artifactId></dependency>";
-        let a = with_profile(
-            &module("a", bare),
-            "new",
-            "<ct.version>1.12.0</ct.version>",
-        );
+        let a = with_profile(&module("a", bare), "new", "<ct.version>1.12.0</ct.version>");
         let files = fs(&[
             ("pom.xml", &root),
             ("a/pom.xml", &a),

From 1d77282a63928dc3ad290b278f18b612e9b9265b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 28 Oct 2026 16:05:31 +0000
Subject: [PATCH 4/5] Withhold Maven vex on modules left at base

Unpinning the root was not enough: vex counted the patch as wired
whenever any pom named the suffixed version, so a rewritten sibling
let it attest while a module left at an uncertain ${prop} built the
unpatched jar.

- vex liveness for a reactor now re-plans the declarations and
  withholds when one is left at an undefined, inheritor-overridden or
  profile-overridden version. The GC and --check reference test is
  unchanged, so a referenced tree is never pruned.
- A possibly-matching declaration with an undefined ${...} groupId or
  artifactId and its own version also leaves the root unpinned.
- Parent inference is limited to model 4.1.0, and a Maven 4 child's
  ${project.version}/${project.groupId} come from the inferred parent.
- The inheritor and profile override searches are one walk.

Assisted-by: Claude Code:claude-opus-5-5
---
 .../socket-patch-core/src/vendor/jvm/apply.rs |   9 +-
 .../src/vendor/jvm/maven_reactor.rs           | 283 ++++++++++++++----
 2 files changed, 229 insertions(+), 63 deletions(-)

diff --git a/crates/socket-patch-core/src/vendor/jvm/apply.rs b/crates/socket-patch-core/src/vendor/jvm/apply.rs
index e9d17f762..212a39a50 100644
--- a/crates/socket-patch-core/src/vendor/jvm/apply.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/apply.rs
@@ -830,10 +830,11 @@ pub fn entry_references(root: &Path, entry: &VendorEntry) -> bool {
     referenced || reader.read_error.borrow().is_some()
 }
 
-/// The liveness proof `vex` needs: every half of the entry is wired, and
-/// a Gradle half's script is intact and re-plans with no refusal and no
+/// The liveness proof `vex` needs: every half of the entry is wired, a
+/// Gradle half's script is intact and re-plans with no refusal and no
 /// degraded warning (a conflicting rule or unchecked build logic added
-/// since vendoring withholds attestation).
+/// since vendoring withholds attestation), and no Maven declaration is
+/// left at a version that may still read the base.
 pub fn entry_wired_checked(root: &Path, entry: &VendorEntry) -> Result<bool, String> {
     let (g, a, v) = entry_gav(entry)?;
     let c = Coords {
@@ -856,7 +857,7 @@ pub fn entry_wired_checked(root: &Path, entry: &VendorEntry) -> Result<bool, Str
             wired = gradle::wired_checked(&read, &list, &c).map_err(|e| e.detail);
         }
         if maven && wired == Ok(true) {
-            wired = maven_reactor::wired_checked(&read, &c).map_err(|e| e.detail);
+            wired = maven_reactor::attestable_checked(&read, &c).map_err(|e| e.detail);
         }
         wired
     };
diff --git a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
index 115e10695..8ddf66b5f 100644
--- a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
@@ -163,6 +163,7 @@ pub fn plan_with_external(
             &mut warnings,
             &mut unpinned,
             &mut managed_roots,
+            &mut BTreeSet::new(),
         );
     }
 
@@ -460,6 +461,47 @@ pub fn wired_checked(read: ReadFn<'_>, c: &Coords<'_>) -> Result<bool, JvmRefusa
     })
 }
 
+/// [`wired_checked`], and no declaration of `c`'s g:a is left at a version
+/// that may still read the base: a `${...}` the checkout does not define
+/// or that an inheriting pom or a profile moves (#513, #459). Such a
+/// module builds the unpatched jar, so `vex` must not attest.
+pub fn attestable_checked(read: ReadFn<'_>, c: &Coords<'_>) -> Result<bool, JvmRefusal> {
+    let sv = c.suffixed_version();
+    let reactor = Reactor::discover(read)?;
+    if !reactor
+        .scope
+        .iter()
+        .any(|rel| reactor.poms[rel].doc.masked.contains(&sv))
+    {
+        return Ok(false);
+    }
+    let patch = JvmPatch {
+        group_id: c.group_id,
+        artifact_id: c.artifact_id,
+        version: c.version,
+        uuid: c.uuid,
+        jar: &[],
+        upstream_pom: &[],
+        upstream_module: None,
+        extra_artifacts: &[],
+        patched_members: &[],
+    };
+    let mut uncertain = BTreeSet::new();
+    for rel in &reactor.scope {
+        reactor.rewrite_declarations(
+            rel,
+            &patch,
+            &sv,
+            &mut BTreeMap::new(),
+            &mut Vec::new(),
+            &mut BTreeSet::new(),
+            &mut BTreeSet::new(),
+            &mut uncertain,
+        );
+    }
+    Ok(uncertain.is_empty())
+}
+
 /// `<!-- socket-patch <uuid>:` — the start of `c`'s pin comment.
 fn pin_tag(c: &Coords<'_>) -> String {
     format!("{PIN_TAG}{}:", c.uuid)
@@ -1313,6 +1355,9 @@ struct Pom {
     props: BTreeMap<String, String>,
     /// Each profile's id and `<properties>`, in document order.
     profile_props: Vec<(String, BTreeMap<String, String>)>,
+    /// Model 4.1.0 (Maven 4): omitted parent coordinates are inferred
+    /// from the pom at the relative path.
+    infers_parent: bool,
 }
 
 /// A pom and one of its profiles' `<properties>`.
@@ -1360,7 +1405,10 @@ impl Pom {
             })
             .filter(|(_, props)| !props.is_empty())
             .collect();
+        let infers_parent = doc.child_text(project, "modelVersion").as_deref() == Some("4.1.0")
+            || doc.masked.contains("maven.apache.org/POM/4.1.0");
         Ok(Pom {
+            infers_parent,
             dir: rel.rsplit_once('/').map_or("", |(d, _)| d).to_string(),
             group: doc.child_text(project, "groupId"),
             artifact: doc.child_text(project, "artifactId"),
@@ -1574,12 +1622,20 @@ impl Reactor {
 
     fn lookup_with(&self, rel: &str, name: &str, overlay: Option<Overlay<'_>>) -> Option<String> {
         let pom = &self.poms[rel];
+        // A Maven 4 child may omit its parent's coordinates too: they come
+        // from the inferred local parent.
+        let version = || {
+            self.chain(rel)
+                .find_map(|p| self.poms[p].effective_version())
+                .map(str::to_string)
+        };
         match name {
-            "project.version" | "pom.version" => {
-                return pom.effective_version().map(str::to_string);
-            }
+            "project.version" | "pom.version" => return version(),
             "project.groupId" | "pom.groupId" => {
-                return pom.effective_group().map(str::to_string);
+                return self
+                    .chain(rel)
+                    .find_map(|p| self.poms[p].effective_group())
+                    .map(str::to_string);
             }
             "project.artifactId" | "pom.artifactId" => return pom.artifact.clone(),
             "project.parent.version" => return pom.parent.as_ref()?.version.clone(),
@@ -1597,31 +1653,37 @@ impl Reactor {
         }) {
             return Some(v.clone());
         }
-        (name == "version")
-            .then(|| pom.effective_version().map(str::to_string))
-            .flatten()
+        (name == "version").then(version).flatten()
     }
 
-    /// A version `declared` (with `${...}`) reaches in some pom that reads
-    /// it, `rel` or an inheritor, when a profile on that pom's chain is
-    /// active, and that is neither the base nor `sv`: the pom and the
-    /// profile's id, and the version. Profile activation is not evaluated,
-    /// so every profile counts.
-    fn profile_override(
+    /// A version `declared` (with `${...}`) reaches in a pom that reads
+    /// it, an inheritor of `rel` or `rel` itself with a profile on its
+    /// chain active, that is neither the base nor `sv`: the version and
+    /// where. Profile activation is not evaluated, so every profile counts
+    /// (one at a time).
+    fn version_override(
         &self,
         rel: &str,
         declared: &str,
         base: &str,
         sv: &str,
-    ) -> Option<(String, String, String)> {
+    ) -> Option<(String, String)> {
+        let moved = |v: &str| !is_base_like(v, base) && v != sv;
         std::iter::once(rel)
             .chain(self.inheritors(rel))
             .find_map(|reader| {
-                self.chain(reader).find_map(|at| {
-                    self.poms[at].profile_props.iter().find_map(|(id, props)| {
-                        let v = self.interpolate_with(reader, declared, 0, Some((at, props)))?;
-                        (!is_base_like(&v, base) && v != sv)
-                            .then(|| (format!("profile {id} of {at}"), v, reader.to_string()))
+                let plain = (reader != rel)
+                    .then(|| self.interpolate(reader, declared, 0))
+                    .flatten()
+                    .filter(|v| moved(v))
+                    .map(|v| (v, reader.to_string()));
+                plain.or_else(|| {
+                    self.chain(reader).find_map(|at| {
+                        self.poms[at].profile_props.iter().find_map(|(id, props)| {
+                            let v =
+                                self.interpolate_with(reader, declared, 0, Some((at, props)))?;
+                            moved(&v).then(|| (v, format!("{reader} under profile {id} of {at}")))
+                        })
                     })
                 })
             })
@@ -1636,8 +1698,9 @@ impl Reactor {
     }
 
     /// Rewrite the base declarations of `rel` and record the
-    /// warnings, the local roots not to pin, and the local roots whose own
-    /// top-level management already covers g:a.
+    /// warnings, the local roots not to pin, the local roots whose own
+    /// top-level management already covers g:a, and the declarations left
+    /// at a version that may still read the base (`uncertain`).
     #[allow(clippy::too_many_arguments)]
     fn rewrite_declarations(
         &self,
@@ -1648,10 +1711,11 @@ impl Reactor {
         warnings: &mut Vec<JvmWarning>,
         unpinned: &mut BTreeSet<String>,
         managed_roots: &mut BTreeSet<String>,
+        uncertain: &mut BTreeSet<String>,
     ) {
         let doc = &self.poms[rel].doc;
         let ga = format!("{}:{}", patch.group_id, patch.artifact_id);
-        self.warn_unresolved_coordinates(rel, patch, warnings);
+        self.warn_unresolved_coordinates(rel, patch, warnings, unpinned, uncertain);
         for (dep, key) in self.keyed_declarations(rel, patch.group_id, patch.artifact_id) {
             if doc
                 .child_text(dep, "type")
@@ -1690,6 +1754,7 @@ impl Reactor {
                         ),
                     ));
                     unpinned.insert(root);
+                    uncertain.insert(at);
                     continue;
                 }
             }
@@ -1714,6 +1779,7 @@ impl Reactor {
                         ));
                         // The explicit version beats any pin of the root.
                         unpinned.insert(root);
+                        uncertain.insert(at);
                         continue;
                     }
                 }
@@ -1724,34 +1790,15 @@ impl Reactor {
                 continue;
             }
             if is_base_like(&resolved, patch.version) {
-                // Maven interpolates after inheritance: a pom that inherits
-                // this declaration and overrides the property must keep its
-                // own version, so the literal SV cannot go here.
-                let overridden = declared.contains("${").then(|| {
-                    self.inheritors(rel).find_map(|p| {
-                        let v = self.interpolate(p, &declared, 0)?;
-                        (!is_base_like(&v, patch.version) && v != sv).then(|| (p.to_string(), v))
-                    })
-                });
-                let profiled = || {
-                    declared
-                        .contains("${")
-                        .then(|| self.profile_override(rel, &declared, patch.version, sv))
-                        .flatten()
-                };
-                if let Some((profile, v, p)) = profiled() {
-                    warnings.push(degraded(
-                        "conflicting_literal_version",
-                        format!(
-                            "{at}: {ga} version {declared} resolves to {v} in {p} under \
-                             {profile}, not {}; left as is and {root} is not pinned",
-                            patch.version
-                        ),
-                    ));
-                    unpinned.insert(root);
-                    continue;
-                }
-                if let Some((p, v)) = overridden.flatten() {
+                // Maven interpolates after inheritance and with the active
+                // profiles: a pom that inherits this declaration and
+                // overrides the property, or a profile that does, must keep
+                // its own version, so the literal SV cannot go here.
+                let overridden = declared
+                    .contains("${")
+                    .then(|| self.version_override(rel, &declared, patch.version, sv))
+                    .flatten();
+                if let Some((v, p)) = overridden {
                     warnings.push(degraded(
                         "conflicting_literal_version",
                         format!(
@@ -1761,6 +1808,7 @@ impl Reactor {
                         ),
                     ));
                     unpinned.insert(root);
+                    uncertain.insert(at);
                     continue;
                 }
                 let span = doc.value_span(version);
@@ -1796,12 +1844,15 @@ impl Reactor {
 impl Reactor {
     /// Warn for each declaration of `rel` that could be `patch`'s g:a but
     /// names a `${...}` groupId or artifactId undefined in the checkout:
-    /// it is left as is, probably unpatched.
+    /// it is left as is, probably unpatched. One with its own version
+    /// beats any pin, so its local root is not pinned.
     fn warn_unresolved_coordinates(
         &self,
         rel: &str,
         patch: &JvmPatch<'_>,
         warnings: &mut Vec<JvmWarning>,
+        unpinned: &mut BTreeSet<String>,
+        uncertain: &mut BTreeSet<String>,
     ) {
         let doc = &self.poms[rel].doc;
         let resolve = |v: &str| self.interpolate(rel, v, 0);
@@ -1835,16 +1886,29 @@ impl Reactor {
                 continue;
             }
             let at = format!("{rel}:{}", doc.line_of(doc.nodes[dep].start));
+            let versioned = doc
+                .child_text(dep, "version")
+                .is_some_and(|v| !v.is_empty());
+            let root = self.local_root(rel);
+            let unpin = if versioned {
+                format!(", and {root} is not pinned")
+            } else {
+                String::new()
+            };
             warnings.push(degraded(
                 "property_unresolved",
                 format!(
                     "{at}: {g}:{a} may be {}:{} but {} is not defined in the checkout; \
-                     left as is, probably unpatched",
+                     left as is, probably unpatched{unpin}",
                     patch.group_id,
                     patch.artifact_id,
                     unresolved.join(", ")
                 ),
             ));
+            if versioned {
+                unpinned.insert(root);
+                uncertain.insert(at);
+            }
         }
     }
 }
@@ -1998,13 +2062,14 @@ fn local_parent_of(
     };
     // Maven 4 (model 4.1.0) infers omitted parent coordinates from the
     // pom at the relative path.
-    let matches = want_group
-        .as_deref()
-        .is_none_or(|g| Some(g) == candidate.effective_group())
-        && want_artifact
-            .as_deref()
-            .is_none_or(|a| Some(a) == candidate.artifact.as_deref())
-        && versions_agree;
+    let infers = poms[rel].infers_parent;
+    let matches = match want_group.as_deref() {
+        None => infers,
+        Some(g) => Some(g) == candidate.effective_group(),
+    } && match want_artifact.as_deref() {
+        None => infers,
+        Some(a) => Some(a) == candidate.artifact.as_deref(),
+    } && versions_agree;
     Ok(matches.then_some(parent_rel))
 }
 
@@ -5391,6 +5456,106 @@ mod tests {
         assert!(unwired(&applied(&files, &plan)));
     }
 
+    fn attestable(files: &Fs) -> (bool, bool) {
+        let read = |p: &str| files.get(p).cloned();
+        let c = Coords {
+            group_id: "org.apache.commons",
+            artifact_id: "commons-text",
+            version: "1.10.0",
+            uuid: UUID,
+        };
+        (
+            wired_checked(&read, &c).unwrap(),
+            attestable_checked(&read, &c).unwrap(),
+        )
+    }
+
+    /// A sibling rewritten to SV wires the patch, but a module left at an
+    /// uncertain `${...}` still builds the base: not attestable.
+    #[test]
+    fn an_uncertain_module_beside_a_rewritten_one_is_not_attestable() {
+        let profiled = with_profile(
+            &module("a", &dep("${ct.version}")),
+            "new",
+            "<ct.version>1.11.0</ct.version>",
+        );
+        let root = ROOT.replace(
+            "  <modules>",
+            "  <properties><ct.version>1.10.0</ct.version></properties>\n  <modules>",
+        );
+        for (root, a) in [
+            (ROOT.to_string(), module("a", &dep("${remote.prop}"))),
+            (root, profiled),
+        ] {
+            let files = fs(&[
+                ("pom.xml", &root),
+                ("a/pom.xml", &a),
+                ("b/pom.xml", &module("b", &dep("1.10.0"))),
+            ]);
+            let (_, after) = vendor(&files);
+            assert_eq!(text(&after, "b/pom.xml"), module("b", &dep(SV)));
+            assert_eq!(attestable(&after), (true, false), "{a}");
+        }
+        // Without the uncertain module the same reactor attests.
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", &dep("1.10.0"))),
+        ]);
+        let (_, after) = vendor(&files);
+        assert_eq!(attestable(&after), (true, true));
+    }
+
+    /// #513: a possibly-matching declaration named through an undefined
+    /// `${...}` groupId with its own version beats any pin.
+    #[test]
+    fn an_unresolved_coordinate_with_a_version_leaves_the_root_unpinned() {
+        let a = module(
+            "a",
+            "<dependency><groupId>${ext.group}</groupId>\
+             <artifactId>commons-text</artifactId><version>1.10.0</version></dependency>",
+        );
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["property_unresolved"]);
+        assert!(!root_pinned(&plan, &files));
+        assert!(unwired(&applied(&files, &plan)));
+    }
+
+    /// Maven 4 children also inherit the inferred parent's version, and a
+    /// model 4.0.0 pom does not infer a parent.
+    #[test]
+    fn maven_4_parent_inference_is_4_1_only_and_carries_the_version() {
+        let root = "<project xmlns=\"http://maven.apache.org/POM/4.1.0\">\n  \
+            <modelVersion>4.1.0</modelVersion>\n  <groupId>org.apache.commons</groupId>\n  \
+            <artifactId>root</artifactId>\n  <version>1.10.0</version>\n  \
+            <packaging>pom</packaging>\n  <subprojects><subproject>a</subproject></subprojects>\n\
+            </project>\n";
+        let a41 = format!(
+            "<project xmlns=\"http://maven.apache.org/POM/4.1.0\">\n  \
+             <modelVersion>4.1.0</modelVersion>\n  <parent/>\n  <artifactId>a</artifactId>\n  \
+             <dependencies>\n    {}\n  </dependencies>\n</project>\n",
+            dep("${project.version}")
+        );
+        let files = fs(&[("pom.xml", root), ("a/pom.xml", &a41)]);
+        let (plan, after) = vendor(&files);
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert_eq!(
+            text(&after, "a/pom.xml"),
+            a41.replace("${project.version}", SV)
+        );
+        let a40 = a41
+            .replace("POM/4.1.0", "POM/4.0.0")
+            .replace(">4.1.0<", ">4.0.0<");
+        let files = fs(&[("pom.xml", root), ("a/pom.xml", &a40)]);
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["property_unresolved"]);
+    }
+
     /// A profile that sets the base version (or a user property that wins
     /// over every profile) changes nothing.
     #[test]

From 4c1b5b282333b183928d6a9429e879e6b6a4801f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 28 Oct 2026 17:16:01 +0000
Subject: [PATCH 5/5] Treat a profile that undefines the version as moved

A profile (or inheriting pom) that points the version property at a
name the checkout does not define made the planner skip it and still
rewrite the declaration to the suffixed base. Such an override now
counts as moving the version, so the declaration is left as is and
the root is not pinned.

The CLI regression test now also covers a sibling module at the
literal base: it is rewritten and wired, yet vex still withholds
because the uncertain module builds the unpatched jar.

Assisted-by: Claude Code:claude-opus-5-5
---
 .../socket-patch-cli/tests/vendor_jvm_cli.rs  | 33 +++++++++++++++----
 .../src/vendor/jvm/maven_reactor.rs           | 20 ++++++++---
 2 files changed, 43 insertions(+), 10 deletions(-)

diff --git a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
index 17b8ec7af..18b749a51 100644
--- a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
+++ b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
@@ -1159,7 +1159,7 @@ fn gradle_vendor_533_unpatched_classifier_copy_withholds_vex() {
 /// still takes unpatched.
 #[test]
 fn maven_reactor_uncertain_property_version_withholds_vex() {
-    for (extra, reason) in [
+    let cases = [
         ("", "property_unresolved"),
         (
             "<properties><foo.version>1.0</foo.version></properties>\
@@ -1167,12 +1167,18 @@ fn maven_reactor_uncertain_property_version_withholds_vex() {
              </properties></profile></profiles>",
             "conflicting_literal_version",
         ),
-    ] {
+    ];
+    // With a sibling module at the literal base, that module is rewritten
+    // and the patch is wired, yet `a` still builds the base.
+    for ((extra, reason), sibling) in cases
+        .into_iter()
+        .flat_map(|case| [(case, false), (case, true)])
+    {
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         fixture(root, Shape::Reactor, &[("foo", FOO_UUID)]);
-        let a = std::fs::read_to_string(root.join("proj/a/pom.xml")).unwrap();
-        let a = a
+        let pristine = std::fs::read_to_string(root.join("proj/a/pom.xml")).unwrap();
+        let a = pristine
             .replace(
                 "<version>1.0</version></dependency>",
                 "<version>${foo.version}</version></dependency>",
@@ -1182,6 +1188,17 @@ fn maven_reactor_uncertain_property_version_withholds_vex() {
                 &format!("<artifactId>a</artifactId>{extra}"),
             );
         write(root, "proj/a/pom.xml", a.as_bytes());
+        if sibling {
+            let agg = std::fs::read_to_string(root.join("proj/pom.xml")).unwrap();
+            let agg = agg.replace(
+                "<module>a</module>",
+                "<module>a</module>\n    <module>b</module>",
+            );
+            write(root, "proj/pom.xml", agg.as_bytes());
+            std::fs::create_dir_all(root.join("proj/b")).unwrap();
+            let b = pristine.replace("<artifactId>a</artifactId>", "<artifactId>b</artifactId>");
+            write(root, "proj/b/pom.xml", b.as_bytes());
+        }
         let env = ok(root, &["vendor"]);
         assert!(
             env.to_string().contains(&format!("reason: {reason}")),
@@ -1191,7 +1208,11 @@ fn maven_reactor_uncertain_property_version_withholds_vex() {
             std::fs::read_to_string(root.join("proj/a/pom.xml")).unwrap(),
             a
         );
-        assert!(!wiring_text(root).contains("-socket."), "{reason}: pinned");
+        assert_eq!(
+            wiring_text(root).contains("-socket."),
+            sibling,
+            "{reason}: wired"
+        );
         let vex = root.join("vex.json");
         let (_, env) = socket(
             root,
@@ -1210,7 +1231,7 @@ fn maven_reactor_uncertain_property_version_withholds_vex() {
                 "skipped".to_string(),
                 "vendor_unwired".to_string()
             )],
-            "{reason}: {env}"
+            "{reason} (sibling: {sibling}): {env}"
         );
         assert!(!vex.exists(), "{env}");
     }
diff --git a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
index 8ddf66b5f..d37809dca 100644
--- a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
@@ -1672,16 +1672,22 @@ impl Reactor {
         std::iter::once(rel)
             .chain(self.inheritors(rel))
             .find_map(|reader| {
+                // `rel` resolves it, so a reader or profile that does not
+                // has redefined something it names: that moves it too.
+                let undefined = || "an undefined value".to_string();
                 let plain = (reader != rel)
-                    .then(|| self.interpolate(reader, declared, 0))
-                    .flatten()
+                    .then(|| {
+                        self.interpolate(reader, declared, 0)
+                            .unwrap_or_else(undefined)
+                    })
                     .filter(|v| moved(v))
                     .map(|v| (v, reader.to_string()));
                 plain.or_else(|| {
                     self.chain(reader).find_map(|at| {
                         self.poms[at].profile_props.iter().find_map(|(id, props)| {
-                            let v =
-                                self.interpolate_with(reader, declared, 0, Some((at, props)))?;
+                            let v = self
+                                .interpolate_with(reader, declared, 0, Some((at, props)))
+                                .unwrap_or_else(undefined);
                             moved(&v).then(|| (v, format!("{reader} under profile {id} of {at}")))
                         })
                     })
@@ -5409,6 +5415,12 @@ mod tests {
                 "<ct.minor>10</ct.minor><ct.version>1.${ct.minor}.0</ct.version>",
                 "<ct.minor>11</ct.minor>",
             ),
+            // A profile pointing the property at a name the checkout
+            // does not define (Bugbot on #1787).
+            (
+                "<ct.version>1.10.0</ct.version>",
+                "<ct.version>${corp.ct.version}</ct.version>",
+            ),
         ] {
             let root = with_profile(
                 &ROOT.replace(