openrewrite / openrewrite/rewrite

ChangeDependency - transitive dependency pitfall

Open
#6,552 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

maven recipe
Dominant language
Java
Stars
3.7k
Forks
571
Avg merge
13h 12m
Merged PRs (30d)
261

Description

I've observed this in a few spots, recently in the Jackson recipes. But I think it's a pattern problem, so I'm opening it here in rewrite.

Consider a recipe like this, where a library has done a GAV change, and so we have a bunch of ChangeDependency and ChangeType calls to migrate:
https://github.com/openrewrite/rewrite-jackson/blob/b5ff3f25509117b15492d234c9eb7e08dbd5ab66/src/main/resources/META-INF/rewrite/jackson-2-3.yml

ChangeType updates the code to match the library's new version, and ChangeDependency ensures that the project's build picks up the new version instead of the old. All good, all intuitive.

But, it falls down on projects which are pulling in that library transitively, not directly. In that case, the project build will still pull in the library's old version, and the updated project code (referencing the new packages) will not compile.
(unless we're talking about, say, spring-boot-starter-jackson, and some other spring recipe in the chain will handle updating the spring dependency in a way that gets us to the newer jackson)

One way to fix is with a corresponding AddDependency recipe invocation for each ChangeDependency, with acceptTransitive set to true. That's what PRs like this have done (several times even within the same file!):

I think this troubleshooting loop could be short-circuited with some new recipe option or composite recipe, which combines the ChangeDependency and AddDependency behaviors.

Thoughts?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the ChangeDependency and AddDependency recipe implementations in rewrite, then inspect the referenced jackson-2-3.yml recipe and the linked rewrite-migrate-java pull requests. Determine how transitive dependencies are handled and define a recipe option or composite behavior that avoids repeated AddDependency calls while preserving direct dependency changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.