Upgrade transitive Maven dependencies
Recipe ID
org.openrewrite.maven.UpgradeTransitiveDependencyVersionArtifact
org.openrewrite:rewrite-mavenUpgrades the version of a transitive dependency in a Maven pom file. Leaves direct dependencies unmodified. When the transitive dependency's version is already governed by a plain <dependencyManagement> entry in the project, that entry is upgraded in place rather than adding a duplicate; otherwise (including a version supplied by an imported BOM) a new managed dependency is added. Can be paired with the regular Upgrade Dependency Version recipe to upgrade a dependency everywhere, regardless of whether it is direct or transitive.
Usage
You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.maven.UpgradeTransitiveDependencyVersion --recipe-option "groupId=org.apache.logging.log4j" --recipe-option "artifactId=log4j-bom" --recipe-option "version=latest.release"If the recipe isn’t available locally, install it with:
mod config recipes jar install org.openrewrite:rewrite-maven:8.88.0Options
| Name | Type | Description |
|---|---|---|
groupIdrequired | String | The first part of a dependency coordinate 'org.apache.logging.log4j:ARTIFACT_ID:VERSION'. e.g. org.apache.logging.log4j |
artifactIdrequired | String | The second part of a dependency coordinate 'org.apache.logging.log4j:log4j-bom:VERSION'. e.g. log4j-bom |
versionrequired | String | An exact version number or node-style semver selector used to select the version number. e.g. latest.release |
scope | String | An optional scope to use for the dependency management tag. e.g. import |
type | String | An optional type to use for the dependency management tag. e.g. pom |
classifier | String | An optional classifier to use for the dependency management tag e.g. test |
versionPattern | String | Allows version selection to be extended beyond the original Node Semver semantics. So for example,Setting 'version' to "25-29" can be paired with a metadata pattern of "-jre" to select 29.0-jre e.g. -jre |
releasesOnly | Boolean | Whether to exclude snapshots from consideration when using a semver selector |
onlyIfUsing | String | Only add managed dependencies to projects having a dependency matching the expression. e.g. org.apache.logging.log4j:log4j* |
addToRootPom | Boolean | Add to the root pom where root is the eldest parent of the pom within the source set. |
because | String | The reason for upgrading the transitive dependency. This will be added as an XML comment preceding the managed dependency. e.g. CVE-2021-1234 |
Data tables
Structured output this recipe can produce.
- Maven metadata failuresAttempts to resolve maven metadata that failed.
org.openrewrite.maven.table.MavenMetadataFailures - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats