Maven add missing version to a dependency

[wesboe]

What problem are you trying to solve?

Spring boot and other frameworks manage dependencies. It can happen the dependency is removed from the dependencies management part. After migration to the new parent version, your application will complain the version of the dependency is missing. This happens when you migrate to Spring Boot 4 for dependencies spring-retry and rest-assured.

What precondition(s) should be checked before applying this recipe?

If the dependency has a version or not.

Description recipe

The recipe should follow the input of other maven recipes like upgradeparentversion.

• groupId
• artifactId
• newVersion
• versionPattern
  Optional is acceptTransitive like with recipe AddDependency. To not add the version if dependency is found in management dependency.

Draft recipe

`
@value
@EqualsAndHashCode(callSuper = false)
public class ExplicitAddDependencyVersion extends Recipe {

@Getter
final String displayName = "Add version to dependency";

@Getter
final String description =
        "Add version to a dependency that is missing it. This can be required when dependency is not managed anymore by a parent pom.";

@Option(
        displayName = "Group",
        description = "The first part of a dependency coordinate `com.google.guava:guava:VERSION`.",
        example = "com.google.guava")
String groupId;

@Option(
        displayName = "Artifact",
        description = "The second part of a dependency coordinate `com.google.guava:guava:VERSION`.",
        example = "guava")
String artifactId;

@Option(
        displayName = "Version",
        description = "An exact version number or node-style semver selector used to select the version number.",
        example = "29.X")
String newVersion;

@Override
public Validated<Object> validate() {
    Validated<Object> validated = super.validate();
    //noinspection ConstantConditions
    if (newVersion != null) {
        validated = validated.and(Semver.validate(newVersion, null));
    }

    return validated;
}

@Override
public TreeVisitor<?, ExecutionContext> getVisitor() {
    return new MavenIsoVisitor<>() {
        @Override
        public Xml.Tag visitTag(Xml.Tag tag, ExecutionContext ctx) {
            Xml.Tag t = super.visitTag(tag, ctx);
            if (isDependencyTag(groupId, artifactId)) {
                if (t.getChildValue("version").isEmpty()) {
                    Xml.Tag versionTag = Xml.Tag.build("<version>" + newVersion + "</version>");

                    t = (Xml.Tag)
                            new AddToTagVisitor<>(t, versionTag, new MavenTagInsertionComparator(t.getChildren()))
                                    .visitNonNull(t, 0, getCursor().getParent());
                    maybeUpdateModel();
                }
            }
            return t;
        }
    };
}

}
`

[timtebeek]

hi! We have a number of recipes in this space already, to either set a version when changing a parent or BOM import as dependencies are dropped, or to override a managed version through UpgradeDependencyVersion. Do none of those apply to fix your use case already? Might help to see a small reproducer of your setup, and what you're (not) seeing changed when running the existing Spring upgrade recipes.

[wesboe]

I tried those but it did not work. Below is an example of a pom.xml. It works for SB3 but fails for SB4
Before
`

4.0.0

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.5.9</version>
    <relativePath/>
</parent>

<groupId>com.example</groupId>
<artifactId>appA</artifactId>
<version>0.1</version>
<packaging>pom</packaging>

    <dependencies>
        <dependency>
            <groupId>org.springframework.retry</groupId>
            <artifactId>spring-retry</artifactId>
        </dependency>
    </dependencies>

`

After
`

4.0.0

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>4.0.2</version>
    <relativePath/>
</parent>

<groupId>com.example</groupId>
<artifactId>appA</artifactId>
<version>0.1</version>
<packaging>pom</packaging>

    <dependencies>
        <dependency>
            <groupId>org.springframework.retry</groupId>
            <artifactId>spring-retry</artifactId>
        </dependency>
    </dependencies>

`

[timtebeek]

Thanks! Then perhaps the easiest way to solve such cases is with a declarative recipe, as we've done in our Moderne recipes:

preconditions:
  - org.openrewrite.maven.search.ModuleHasDependency:
      groupIdPattern: org.springframework.retry
      artifactIdPattern: spring-retry
recipeList:
  - org.openrewrite.java.dependencies.UpgradeDependencyVersion:
      groupId: org.springframework.retry
      artifactId: spring-retry
      newVersion: 2.x
      overrideManagedVersion: true

That works with recipes we already have, potentially removing the need for the above proposed specific recipe, and inclusion of that where applicable. Would that work for you?

[wesboe]

Found the issue. UpgradeDependencyVersion only works if there is a newer version. In this case the management dependency has the latest version. So it will still fail for the Spring Boot 4 upgrade until a newer version of spring-retry is released.

rewrite/rewrite-maven/src/main/java/org/openrewrite/maven/UpgradeDependencyVersion.java

Line 149 in fcbe88b

String newerVersion = MavenDependency.findNewerVersion(d.getGroupId(), d.getArtifactId(), d.getVersion(), getResolutionResult(), metadataFailures,

[wesboe]

Maybe we can add a flag to override version explicitly? Understand its an edge-case. Because if there is a newer version you want to us it. But if there is no newer version you want to be able override it.

[wesboe]

Or we can close the ticket. Its an edge-case and maybe not worth the change.

[timtebeek]

Ah that explains it, thanks! Indeed an edge case that we hadn't anticipated; are you also not seeing a version introduced when you use ChangeParentPom? Because we have explicit handling here:

rewrite/rewrite-maven/src/main/java/org/openrewrite/maven/ChangeParentPom.java

Lines 411 to 422 in be49de4

	// Retain managed versions from the old parent that are not managed in the new parent
	MavenPomDownloader mpd = new MavenPomDownloader(mrr.getProjectPoms(), ctx, mrr.getMavenSettings(), mrr.getActiveProfiles());
	ResolvedPom oldParent = mpd.download(new GroupArtifactVersion(currentGroupId, currentArtifactId, oldVersion), null, resolvedPom, resolvedPom.getRepositories())
	.resolve(emptyList(), mpd, ctx);
	ResolvedPom newParent = mpd.download(new GroupArtifactVersion(targetGroupId, targetArtifactId, targetVersion.get()), null, resolvedPom, resolvedPom.getRepositories())
	.resolve(emptyList(), mpd, ctx);
	List<ResolvedManagedDependency> dependenciesWithoutExplicitVersions = getDependenciesUnmanagedByNewParent(mrr, newParent);
	for (ResolvedManagedDependency dep : dependenciesWithoutExplicitVersions) {
	changeParentTagVisitors.add(new AddManagedDependencyVisitor(
	dep.getGroupId(), dep.getArtifactId(), dep.getVersion() == null ? "" : dep.getVersion(),
	dep.getScope() == null ? null : dep.getScope().toString().toLowerCase(), dep.getType(), dep.getClassifier(), null));
	}

[wesboe]

Hi also does not work with ChangeParentPom.

[timtebeek]

I wrote a test to confirm the reported behavior, but found that ChangeParentPom does correctly handle this scenario. When upgrading spring-boot-starter-parent from 3.5.9 to 4.0.2, the recipe detects that spring-retry is no longer managed by the new parent and adds it to <dependencyManagement> with an explicit version.

The test is in #6790 — it complements the existing bringsDownRemovedManagedVersion test by covering the grandparent POM chain case (spring-boot-starter-parent → spring-boot-dependencies).

Could you share the exact recipe configuration you're using? The issue might be in a higher-level composite recipe rather than ChangeParentPom itself.

[timtebeek]

Hmm, ideally we'd fix that then; would it be possible for you to change this unit test to replicate your situation?

@Issue("https://github.com/openrewrite/rewrite/issues/6770")
@Test
void bringsDownRemovedManagedVersionFromGrandparent() {
    rewriteRun(
      spec -> spec.recipe(new ChangeParentPom(
        "org.springframework.boot", "org.springframework.boot",
        "spring-boot-starter-parent", "spring-boot-starter-parent",
        "4.0.2",
        null, null, null, null, null)),
      pomXml(
        """
          <project>
              <modelVersion>4.0.0</modelVersion>
              <groupId>com.mycompany</groupId>
              <artifactId>child</artifactId>
              <version>1.0.0-SNAPSHOT</version>
              <parent>
                  <groupId>org.springframework.boot</groupId>
                  <artifactId>spring-boot-starter-parent</artifactId>
                  <version>3.5.9</version>
                  <relativePath/>
              </parent>
              <dependencies>
                <dependency>
                  <groupId>org.springframework.retry</groupId>
                  <artifactId>spring-retry</artifactId>
                </dependency>
              </dependencies>
          </project>
          """,
        """
          <project>
              <modelVersion>4.0.0</modelVersion>
              <groupId>com.mycompany</groupId>
              <artifactId>child</artifactId>
              <version>1.0.0-SNAPSHOT</version>
              <parent>
                  <groupId>org.springframework.boot</groupId>
                  <artifactId>spring-boot-starter-parent</artifactId>
                  <version>4.0.2</version>
                  <relativePath/>
              </parent>
              <dependencyManagement>
                  <dependencies>
                      <dependency>
                          <groupId>org.springframework.retry</groupId>
                          <artifactId>spring-retry</artifactId>
                          <version>2.0.12</version>
                      </dependency>
                  </dependencies>
              </dependencyManagement>
              <dependencies>
                <dependency>
                  <groupId>org.springframework.retry</groupId>
                  <artifactId>spring-retry</artifactId>
                </dependency>
              </dependencies>
          </project>
          """
      )
    );
}

[timtebeek]

If it helps I've opened a draft PR that allows you to immediately check out the branch and run the test, before altering it to match:

• Add test for ChangeParentPom retaining managed version from grandparent #6790