Ensure proper "because" ordering for multiple Maven dependencies#6352
Merged
jkschneider merged 1 commit intomainfrom Nov 28, 2025
Merged
Ensure proper "because" ordering for multiple Maven dependencies#6352jkschneider merged 1 commit intomainfrom
jkschneider merged 1 commit intomainfrom
Conversation
bmuschko
changed the title
jkschneider
approved these changes
Nov 28, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's changed?
The fix introduces
AddDependencyWithCommentVisitor, which adds both the comment and dependency in a single atomic operation, ensuring they stay together. Additionally, when finding the insertion position, the new logic skips over existing comments and inserts before any preceding comments that belong to an existing dependency, preventing new content from being inserted between a comment and its associated dependency.What's your motivation?
The PR Align "because" option between Gradle and Maven update transitive dependencies recipe #6160 introduced a "because" option to Maven's AddManagedDependency and UpgradeTransitiveDependencyVersion recipes, allowing a reason (e.g., CVE ID) to be added as an XML comment before managed dependencies. However, when multiple dependencies were added with "because" comments, the comments could become associated with the wrong dependencies due to how InsertDependencyComparator sorts dependencies alphabetically.
This issue surfaced when adding tests in https://github.com/moderneinc/rewrite-java-security/pull/265. See the
@Disabledtest case.Anything in particular you'd like reviewers to focus on?
No