Skip to content

AddDependency: tests showing version update inconsistency with test sources#6963

Draft
Jenson3210 wants to merge 2 commits intomainfrom
add-dep-scope-version-discrepancy
Draft

AddDependency: tests showing version update inconsistency with test sources#6963
Jenson3210 wants to merge 2 commits intomainfrom
add-dep-scope-version-discrepancy

Conversation

@Jenson3210
Copy link
Copy Markdown
Contributor

@Jenson3210 Jenson3210 commented Mar 12, 2026

Summary

AddDependency with onlyIfUsing=null did not update an existing dependency's version when only test sources were present. This happened because:

  1. The compile scope check (lines 228-239) found the dependency at a different version and fell through (correct)
  2. The test/provided scope check (lines 243-250) then matched on groupId + artifactId without checking the version, causing an early return that skipped the update
  3. Even if the test/provided check was bypassed, AddDependencyVisitor would block the change as a "scope reduction" (compile → test)

Fix

  • The compile scope check now handles version updates directly when the dependency is direct and the recipe scope is unspecified or compile, calling AddDependencyVisitor with compile scope
  • When the recipe explicitly requests a narrower scope (e.g. runtime), the existing behavior is preserved: the compile-scope dep is considered sufficient
  • The test/provided scope check now includes a version comparison, matching the compile scope check behavior, for dependencies exclusively in those scopes

Test plan

  • existingDependencyUpdatedWithMainSources — compile scope, version bumps from 29.0-jre → 30.0-jre
  • existingDependencyUpdatedWithTestSourcesOnly — test scope (only srcTestJava), version now correctly bumps from 29.0-jre → 30.0-jre
  • All 49 existing AddDependencyTest cases pass, including addDependencyDoesntAddWhenExistingDependencyWithBroaderScope (explicit scope="runtime" with compile dep — no changes)

…source sets

Two tests demonstrate that AddDependency with onlyIfUsing=null behaves differently
depending on which source set is present:

- existingDependencyUpdatedWithMainSources: with srcMainJava, an existing dependency
  (guava 29.0-jre) is correctly updated to 30.0-jre
- existingDependencyNotUpdatedWithTestSourcesOnly: with only srcTestJava, the same
  dependency is NOT updated because the test/provided scope check (lines 243-250)
  matches on groupId + artifactId only without checking the version, causing an early
  return. The compile scope check (lines 228-239) does include a version check.
…sent

When a compile-scope dependency exists at a different version and the resolved
scope is test (because only test sources are present), the recipe would skip the
update. The compile scope check now handles version updates directly, using
compile scope for AddDependencyVisitor, instead of falling through to the
test/provided check which caused a scope-reduction block.

The test/provided scope check also now includes a version comparison, matching
the compile scope check behavior, for dependencies that are exclusively in
test/provided scope.

Fixes #6962
@Jenson3210 Jenson3210 marked this pull request as ready for review March 30, 2026 10:58
@github-project-automation github-project-automation bot moved this from In Progress to Ready to Review in OpenRewrite Mar 30, 2026
@Jenson3210 Jenson3210 marked this pull request as draft March 30, 2026 11:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Ready to Review

Development

Successfully merging this pull request may close these issues.

AddDependency: version update skipped when only test sources are present

2 participants