JavaSourceSetUpdater in dependency recipes breaks rewrite-spring CI

Summary

Since rewrite 8.79.2, the scheduled CI in openrewrite/rewrite-spring has 5 consistently failing tests. The failures started on April 11, immediately after the 8.79.2 release (April 10, 23:25 UTC) was picked up by the latest.integration resolution. The last passing scheduled run was April 10 at 18:40 UTC.

• PR #7358 (shipped in 8.79.3) fixed the flywayStarterOmitsVersionWhenManagedByParent test but these 5 failures persist.

Root Cause

• PR #7202 ("Expand star imports in ChangePackage and related recipes") added JavaSourceSetUpdater integration to AddDependency, ChangeDependency, RemoveDependency, and UpgradeDependencyVersion for both Maven and Gradle. This causes:

1. Cycle inflation: Marker updates in cycle 1 trigger unnecessary cycle 2
2. Silent recipe failures: Dependency recipes fail to apply changes (ChangeDependency doesn't rename, AddDependency doesn't add)

Failing Tests

Failing CI Runs

• April 13 scheduled: https://github.com/openrewrite/rewrite-spring/actions/runs/24361499711
• April 12 scheduled: https://github.com/openrewrite/rewrite-spring/actions/runs/24313556406
• April 11 scheduled: https://github.com/openrewrite/rewrite-spring/actions/runs/24288866962
• April 14 PR (with 8.79.3): https://github.com/openrewrite/rewrite-spring/actions/runs/24393073914 (same 5 failures)

Last passing scheduled run (April 10, pre-8.79.2): https://github.com/openrewrite/rewrite-spring/actions/runs/24258414542

Analysis

• The JavaSourceSetUpdater changes in PR #7202 modified the Gradle dependency recipes in three ways:

1. Scanner phase: Records modulesWithOldDependency and moduleRepositories by scanning GradleProject configurations
2. isAcceptable: Now also accepts JavaSourceFile instances so the editing visitor processes Java source files
3. visit: For Java source files, calls updateJavaSourceSet() which downloads JARs and updates type information

The RenameDeprecatedStartersManagedVersionsTest failures are particularly telling: the UpgradeSpringBoot_4_0 recipe chain successfully upgrades the Spring Boot plugin version (from 3.4.1 to 4.0.5), but the subsequent ChangeDependency sub-recipe for renaming spring-boot-starter-web → spring-boot-starter-webmvc silently doesn't fire. This suggests the JavaSourceSetUpdater integration in either UpgradeDependencyVersion or ChangeDependency is interfering with the recipe chain execution.

Affected Files

• rewrite-gradle/src/main/java/org/openrewrite/gradle/ChangeDependency.java
• rewrite-gradle/src/main/java/org/openrewrite/gradle/AddDependency.java
• rewrite-gradle/src/main/java/org/openrewrite/gradle/UpgradeDependencyVersion.java
• rewrite-maven/src/main/java/org/openrewrite/maven/utilities/JavaSourceSetUpdater.java
• rewrite-java/src/main/java/org/openrewrite/java/marker/JavaSourceSet.java

Start by reproducing the five named failures in rewrite-spring, then read JavaSourceSetUpdater.java and the dependency recipe files in rewrite-gradle listed under Affected Files. Trace the scanner, isAcceptable, and visit changes from PR #7202. Done means the five tests pass, dependency changes apply, and no unnecessary second cycle occurs.