Skip to content

Commit 2ae43a8

Browse files
authored
Fix empty dependencies block left after constraint-to-rule conversion (#6754)
* Add failing test for apply from: with Spring DM plugin When dependencies are declared in a separate file loaded via `apply from: 'dependencies.gradle'` and the Spring dependency management plugin is active, UpgradeTransitiveDependencyVersion incorrectly: 1. Adds configurations.all/resolutionStrategy to both build.gradle AND dependencies.gradle (should only be in build.gradle) 2. Adds an empty dependencies {} block to build.gradle 3. Creates syntax errors in dependencies.gradle * Fix transitive dependency overrides duplicated in apply from: scripts When a Gradle project uses `apply from: 'dependencies.gradle'` to define dependencies in a separate file, UpgradeTransitiveDependencyVersion was adding constraints (and resolutionStrategy rules for Spring DM) to BOTH build.gradle and the applied script. This caused: - Duplicate configurations.all blocks - Syntax errors in the applied script - Empty dependencies {} blocks left behind Only add constraints to primary build files (build.gradle/build.gradle.kts), not to applied scripts. Also fix DependencyConstraintToRule to properly remove empty dependencies blocks with 0 statements. * Remove redundant isPrimaryBuildFile check from UpgradeTransitiveDependencyVersion Applied scripts like dependencies.gradle already don't get constraints added due to the DEPENDENCIES_DSL_MATCHER not matching non-type-attributed method invocations in applied scripts. The isPrimaryBuildFile guard was redundant. The actual fix is the DependencyConstraintToRule isEmptyDependenciesBlock change (from the previous commit) which properly cleans up empty dependencies {} blocks after constraints are converted to resolutionStrategy.
1 parent 878b52a commit 2ae43a8

2 files changed

Lines changed: 81 additions & 0 deletions

File tree

rewrite-gradle/src/main/java/org/openrewrite/gradle/DependencyConstraintToRule.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,9 @@ private static boolean isEmptyDependenciesBlock(J.MethodInvocation m) {
460460
J.Lambda l = (J.Lambda) m.getArguments().get(0);
461461
if (l.getBody() instanceof J.Block) {
462462
J.Block b = (J.Block) l.getBody();
463+
if (b.getStatements().isEmpty()) {
464+
return true;
465+
}
463466
if (b.getStatements().size() == 1) {
464467
return b.getStatements().get(0) instanceof J.Return && ((J.Return) b.getStatements().get(0)).getExpression() == null;
465468
}

rewrite-gradle/src/test/java/org/openrewrite/gradle/UpgradeTransitiveDependencyVersionTest.java

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,44 @@ void addConstraint() {
8181
);
8282
}
8383

84+
@Test
85+
void addConstraintWithApplyFrom() {
86+
rewriteRun(
87+
buildGradle(
88+
"""
89+
dependencies {
90+
implementation 'org.openrewrite:rewrite-java:7.0.0'
91+
}
92+
""",
93+
spec -> spec.path("dependencies.gradle")
94+
),
95+
buildGradle(
96+
"""
97+
plugins {
98+
id 'java'
99+
}
100+
repositories { mavenCentral() }
101+
apply from: 'dependencies.gradle'
102+
""",
103+
"""
104+
plugins {
105+
id 'java'
106+
}
107+
repositories { mavenCentral() }
108+
apply from: 'dependencies.gradle'
109+
110+
dependencies {
111+
constraints {
112+
implementation('com.fasterxml.jackson.core:jackson-core:2.12.5') {
113+
because 'CVE-2024-BAD'
114+
}
115+
}
116+
}
117+
"""
118+
)
119+
);
120+
}
121+
84122
@Test
85123
void addConstraintForDependenciesDeclaredInMultipleConfigurationsThatExtendFromDifferentResolvableConfigurations() {
86124
rewriteRun(
@@ -995,6 +1033,46 @@ void useResolutionStrategyWhenSpringDependencyManagementPluginIsPresent() {
9951033
);
9961034
}
9971035

1036+
@Test
1037+
void useResolutionStrategyWithApplyFromWhenSpringDependencyManagementPluginIsPresent() {
1038+
rewriteRun(
1039+
buildGradle(
1040+
"""
1041+
dependencies {
1042+
implementation 'org.openrewrite:rewrite-java:7.0.0'
1043+
}
1044+
""",
1045+
spec -> spec.path("dependencies.gradle")
1046+
),
1047+
buildGradle(
1048+
"""
1049+
plugins {
1050+
id 'java'
1051+
id 'io.spring.dependency-management' version '1.1.5'
1052+
}
1053+
repositories { mavenCentral() }
1054+
apply from: 'dependencies.gradle'
1055+
""",
1056+
"""
1057+
plugins {
1058+
id 'java'
1059+
id 'io.spring.dependency-management' version '1.1.5'
1060+
}
1061+
repositories { mavenCentral() }
1062+
apply from: 'dependencies.gradle'
1063+
configurations.all {
1064+
resolutionStrategy.eachDependency { details ->
1065+
if (details.requested.group == 'com.fasterxml.jackson.core' && details.requested.name == 'jackson-core') {
1066+
details.useVersion('2.12.5')
1067+
details.because('CVE-2024-BAD')
1068+
}
1069+
}
1070+
}
1071+
"""
1072+
)
1073+
);
1074+
}
1075+
9981076
@Test
9991077
void noChangesIfDependencyIsAlsoPresentOnProject() {
10001078
rewriteRun(

0 commit comments

Comments
 (0)