Support adding Gradle constraints for upgrading versions of transitive dependencies

[billkoch]

First I just wanted to say thank you for all the work that's gone into this project! As someone who's been upgrading Java projects and addressing CVEs in code bases, I'm excited to see a programmable way of handling such monotonous tasks.

One common thing I find myself doing is upgrading the versions of transitive dependencies using Gradle's dependency constraints feature:

// build.gradle

dependencies {
  constraints {
    implementation('org.apache.commons:commons-compress:1.21') {
      because 'to address CVE-2021-36090'
    }
  }
}

I didn't see any documentation or recipes around doing this, although I certainly could have missed it. Does this seem like a feature you all would like to support?

[sambsnyd]

Hi @billkoch. We don't have that capability right now, but I agree that it would be great to have. Our support for refactoring Gradle build files is very immature.

In the more mature Maven AST we have full transitive dependency resolution information.
In the Gradle AST we don't have that yet, so for now it's impossible to write a Gradle recipe that uses information about transitive dependencies. We plan to add this functionality, but it isn't there yet.

[billkoch]

Thanks for the quick response @sambsnyd! I'm looking forward to this being supported in the future!

[timtebeek]

This has been added in #4027 and expanded since. You can use this via:

• https://docs.openrewrite.org/recipes/gradle/upgradetransitivedependencyversion
• https://docs.openrewrite.org/recipes/java/dependencies/upgradetransitivedependencyversion

Hope that helps!