Upgrade transitive Gradle or Maven dependencies
Recipe ID
org.openrewrite.java.dependencies.UpgradeTransitiveDependencyVersionArtifact
org.openrewrite.recipe:rewrite-java-dependenciesUpgrades the version of a transitive dependency in a Maven pom.xml or Gradle build.gradle. Leaves direct dependencies unmodified. Can be paired with the regular Upgrade Dependency Version recipe to upgrade a dependency everywhere, regardless of whether it is direct or transitive.
Usage
You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.java.dependencies.UpgradeTransitiveDependencyVersion --recipe-option "groupId=org.apache.logging.log4j" --recipe-option "artifactId=log4j-bom" --recipe-option "version=latest.release"If the recipe isn’t available locally, install it with:
mod config recipes jar install org.openrewrite.recipe:rewrite-java-dependencies:1.60.0Options
| Name | Type | Description |
|---|---|---|
groupIdrequired | String | The first part of a dependency coordinate 'org.apache.logging.log4j:ARTIFACT_ID:VERSION'. e.g. org.apache.logging.log4j |
artifactIdrequired | String | The second part of a dependency coordinate 'org.apache.logging.log4j:log4j-bom:VERSION'. e.g. log4j-bom |
versionrequired | String | An exact version number or node-style semver selector used to select the version number. e.g. latest.release |
scope | String | An optional scope to use for the dependency management tag. Relevant only to Maven. e.g. import |
type | String | An optional type to use for the dependency management tag. Relevant only to Maven builds. e.g. pom |
classifier | String | An optional classifier to use for the dependency management tag. Relevant only to Maven. e.g. test |
versionPattern | String | Allows version selection to be extended beyond the original Node Semver semantics. So for example,Setting 'version' to "25-29" can be paired with a metadata pattern of "-jre" to select 29.0-jre e.g. -jre |
because | String | The reason for upgrading the transitive dependency. For example, we could be responding to a vulnerability. e.g. CVE-2021-1234 |
releasesOnly | Boolean | Whether to exclude snapshots from consideration when using a semver selector |
onlyIfUsing | String | Only add managed dependencies to projects having a dependency matching the expression. e.g. org.apache.logging.log4j:log4j* |
addToRootPom | Boolean | Add to the root pom where root is the eldest parent of the pom within the source set. |
Data tables
Structured output this recipe can produce.
- Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats