Overwriting dependencies of multi-module project with wrong group and version

[nedtwigg]

Describe the bug
When referencing a specific commit of a multi-module project, JitPack rewrites the POM so that the other modules in project also get downloaded at the same commit. The bug is that JitPack is also rewriting other entries in the POM, in an unpredictable pattern.

To Reproduce
The latest POM published to mavenCentral is here, condensed below:

com.diffplug.spotless:spotless-plugin-gradle:3.26.1
<dependencies>
com.diffplug.spotless:spotless-lib:1.26.1
com.diffplug.spotless:spotless-lib-extra:1.26.1
com.diffplug.durian:durian-core:1.2.0
com.diffplug.durian:durian-io:1.2.0
com.diffplug.durian:durian-collect:1.2.0
</dependencies>

For this commit, (buildlog), the resultant POM is here, condensed below:

com.diffplug.spotless:spotless-plugin-gradle:228aa3...
<dependencies>
com.diffplug.spotless:spotless-lib:228aa3...
com.diffplug.spotless:spotless-lib-extra:228aa3...
com.diffplug.spotless:durian-core:228aa3...    <-- error: rewrote group and version
com.diffplug.durian:durian-io:1.2.0            <-- ok: did not rewrite group and version
com.diffplug.spotless:durian-collect:228aa3... <-- error: rewrote group and version again
</dependencies>

Expected behavior
I would expect that only the modules in the multi-module project would be rewritten. In this case, that would mean spotless-lib and spotless-lib-extra. It's especially confusing that durian-core and durian-collect are being rewritten, while durian-io is being left alone.

Additional context
We have purchased a custom group, com.diffplug, which we are using above. But we get the same result at the com.github.diffplug location as well.

[jitpack-io]

Hi,

JitPack is looking for .pom files in the build directory and then checks if they've been installed in ~/.m2. For all found artifacts it will rewrite group and version.
In this case it found durian-core and durian-collect in:

• ./plugin-maven/build/localMavenRepository/com/diffplug/durian/durian-core/1.2.0/durian-core-1.2.0.pom
• ./plugin-maven/build/localMavenRepository/com/diffplug/durian/durian-collect/1.2.0/durian-collect-1.2.0.pom

[nedtwigg]

Fascinating! Thanks very much.