Quarkus update command rewrites unrelated dependencies

[siewp]

Describe the bug

The Quarkus update command removes versions which are unrelated to Quarkus (but are dependencies specified in the Quarkus BOM). An example is protobuf-java. See also the discussion here.

Expected behavior

After executing the Quarkus Update command, only Quarkus related dependency versions should be changed. Other dependency versions like protobuf-java should not get changed.

Actual behavior

While the Quarkus Update command rewrites Quarkus dependencies, it is also rewriting other dependencies which are unrelated. Versions seem to be removed, if the version in the pom.xml is equal to the version in the Quarkus BOM.

How to Reproduce?

Reproducer: quarkus-update-issue-reproducer.zip
Notice that the pom.xml contains a protobuf-java dependency with a specified version.

Steps to reproduce:

1. Execute the Quarkus Update command e.g. with ./mvnw io.quarkus.platform:quarkus-maven-plugin:3.16.3:update -N
2. After the update command was executed successfully, the version of protobuf-java is gone.

Output of uname -a or ver

No response

Output of java -version

21.0.5

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

3.9.9

Additional information

No response

[gsmet]

This is what I thought: the issue is with upstream OpenRewrite. I reported it here: openrewrite/rewrite#4679 .
Not sure if they will consider it a bug or not, we will see.

Thanks a lot for taking the time to prepare a reproducer, it helped!

[timtebeek]

Hi @siewp ; upstream project maintain here; I've added some more context in openrewrite/rewrite#4679 (comment) ; would you mind having a look and chiming in there?