Recipe AddDependency doesn't remove version when there is a managed dependency

[rregout]

I have created a rewrite.yml with the following recipe list:

type: specs.openrewrite.org/v1beta/recipe
name: com.example.AddSpringBootStarterDependency
displayName: Add Maven dependency example
recipeList:
  - org.openrewrite.maven.AddManagedDependency:
      groupId: org.springframework.boot
      artifactId: spring-boot-dependencies
      version: 3.3.1
      type: pom
      scope: import
      addToRootPom: true
  - org.openrewrite.maven.AddDependency:
      groupId: org.springframework.boot
      artifactId: spring-boot-starter
      onlyIfUsing: javax.ejb.Singleton
      version: 3.3.1

With this a simple module project:

A parent pom:

<project>
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.example</groupId>
    <artifactId>parent-project</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>pom</packaging>

    <modules>
        <module>services</module>
    </modules>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>javax</groupId>
                <artifactId>javaee-api</artifactId>
                <version>7.0</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
</project>

and a module pom:

<project>
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>com.example</groupId>
        <artifactId>parent-project</artifactId>
        <version>0.0.1-SNAPSHOT</version>
    </parent>

    <artifactId>services</artifactId>
    <version>0.0.1-SNAPSHOT</version>

    <dependencies>
        <dependency>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
        </dependency>
    </dependencies>

</project>

And within the module an example Java class:

package com.example;

import javax.ejb.Singleton;

@Singleton
public class SingletonExample {

}

After running the command mvn -U org.openrewrite.maven:rewrite-maven-plugin:run -Drewrite.activeRecipes=com.example.AddSpringBootStarterDependency the result is a parent pom with

<project>
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.example</groupId>
    <artifactId>parent-project</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>pom</packaging>

    <modules>
        <module>services</module>
    </modules>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>javax</groupId>
                <artifactId>javaee-api</artifactId>
                <version>7.0</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>3.3.1</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
</project>

and the module with:

<project>
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>com.example</groupId>
        <artifactId>parent-project</artifactId>
        <version>0.0.1-SNAPSHOT</version>
    </parent>

    <artifactId>services</artifactId>
    <version>0.0.1-SNAPSHOT</version>

    <dependencies>
        <dependency>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter</artifactId>
            <version>3.3.1</version>
        </dependency>
    </dependencies>

</project>

Why is the version of the dependency spring-boot-starter still in the module pom? It should use the one in de managed dependencies of the parent pom and not adding the version to the module pom.

[timtebeek]

Hoi @rregout ; Some of our recipes, like Upgrade Maven dependency version, have an option Boolean overrideManagedVersion to take a managed version into account. The Add Maven dependency recipe does not have such option (yet).

Other recipes, like Add Maven parent remove managed dependency versions in child projects. The Add managed Maven dependency recipe does not yet remove explicit dependency versions (that I know).

For this case we could go for either option: have AddDependency respect a managed dependency version, or have AddManagedDependency remove explicit versions from now-manged dependencies (and then execute that last in your rewrite.yml above).

Feel free to create an issue from this discussion, and you're welcome to start on a draft pull request that merely converts your examples above into a runnable unit test, to make it clear what you're after. Each of the recipes should already have a similar @DocumentExample test that you can copy and modify on your fork.

[rregout]

Hoi Tim,

I'm not familiar with the code base. But when I look in the code, I would expect that from this line it would check if there is a managed version.

[timtebeek]

Indeed; I've converted this discussion into an issue and provided a unit test and potential cause

• Recipe AddDependency doesn't remove version when there is a managed dependency #4321

Let's continue this on the issue, as that will then have a direct link to any fix.