Dependency Insight

To identify where a specific dependency is being used in your project, including its transitive dependencies and version conflicts, you can use the OpenRewrite recipe org.openrewrite.java.dependencies.DependencyInsight from rewrite-java-dependencies.

This recipe provides detailed insight into a dependency's usage across your project, showing both direct and transitive dependencies. It helps you understand dependency trees, identify version conflicts, and trace where specific libraries are coming from in your build. The recipe generates a data table with comprehensive dependency information.

You can run the search recipe using one of the following methods. Because DependencyInsight takes required groupIdPattern / artifactIdPattern arguments, you'll first wrap it in a small local rewrite.yml so the build tool can pass those arguments.

:::tip Pin versions in CI

Throughout this workshop we use LATEST (Maven) and latest.release (Gradle) so you always get the newest recipes. For reproducible CI and production builds, pin a specific version instead (e.g. <version>1.54.0</version>).

:::

Add the following recipe definition to a rewrite.yml at the root of your project (or, if you're following along on the workshop's books/ module, append a new --- document to its existing books/rewrite.yml):

---
type: specs.openrewrite.org/v1beta/recipe
name: com.yourorg.DependencyInsightExample
displayName: Dependency insight for Gradle and Maven example
recipeList:
  - org.openrewrite.java.dependencies.DependencyInsight:
      groupIdPattern: "*"
      artifactIdPattern: "*"

:::warning Multi-module projects

In multi-module Maven builds, the rewrite-maven-plugin looks for rewrite.yml at the root project directory (the same location as the parent pom.xml), not in each module. If your rewrite.yml lives inside a sub-module, add -Drewrite.configLocation=rewrite.yml (path relative to the module) to the Maven CLI command below, otherwise you will see:

Recipe(s) not found: com.yourorg.DependencyInsightExample

:::

The Moderne CLI allows you to run OpenRewrite recipes on your project without needing to modify your build files, against serialized Lossless Semantic Tree (LST) of your project for a considerable performance boost & across projects.

You will need to have configured the Moderne CLI on your machine before you can run the following command.

If project serialized Lossless Semantic Tree is not yet available locally, then build the LST. This is only needed the first time, or after extensive changes:
shell
```
mod build ~/workspace/
```

If the recipe is not available locally yet, then you can install it once using:

shell
mod config recipes jar install org.openrewrite.recipe:rewrite-java-dependencies:LATEST
mod config recipes yaml install /path/to/your/rewrite.yml

Run the recipe.

shell
mod run ~/workspace/ --recipe com.yourorg.DependencyInsightExample

You will need to have Maven installed on your machine before you can run the following command.

shell
mvn -U org.openrewrite.maven:rewrite-maven-plugin:run --define rewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-java-dependencies:RELEASE --define rewrite.activeRecipes=com.yourorg.DependencyInsightExample --define rewrite.exportDatatables=true

You may add the plugin to your pom.xml file, so that it is available for all developers and CI/CD pipelines.

Add the following to your pom.xml file:

pom.xml
<project>
  <build>
    <plugins>
      <plugin>
        <groupId>org.openrewrite.maven</groupId>
        <artifactId>rewrite-maven-plugin</artifactId>
        <version>LATEST</version>
        <configuration>
          <exportDatatables>true</exportDatatables>
          <activeRecipes>
            <recipe>com.yourorg.DependencyInsightExample</recipe>
          </activeRecipes>
        </configuration>
        <dependencies>
          <dependency>
            <groupId>org.openrewrite.recipe</groupId>
            <artifactId>rewrite-java-dependencies</artifactId>
            <version>LATEST</version>
          </dependency>
        </dependencies>
      </plugin>
    </plugins>
  </build>
</project>

Run the recipe.
shell
```
mvn rewrite:run
```

Gradle init scripts are a good way to try out a recipe without modifying your build.gradle file.

Create a file named init.gradle in the root of your project.

init.gradle
initscript {
    repositories {
        maven { url "https://plugins.gradle.org/m2" }
    }
    dependencies { classpath("org.openrewrite:plugin:latest.release") }
}
rootProject {
    plugins.apply(org.openrewrite.gradle.RewritePlugin)
    dependencies {
        rewrite("org.openrewrite.recipe:rewrite-java-dependencies:latest.release")
    }
    rewrite {
        activeRecipe("com.yourorg.DependencyInsightExample")
        setExportDatatables(true)
    }
    afterEvaluate {
        if (repositories.isEmpty()) {
            repositories {
                mavenCentral()
            }
        }
    }
}

Run the recipe.

shell
gradle --init-script init.gradle rewriteRun

Gradle init scripts are a good way to try out a recipe without modifying your build.gradle.kts file.

Create a file named init.gradle.kts in the root of your project.

init.gradle.kts
initscript {
    repositories {
        maven { url = uri("https://plugins.gradle.org/m2") }
    }
    dependencies { classpath("org.openrewrite:plugin:latest.release") }
}
rootProject {
    plugins.apply(org.openrewrite.gradle.RewritePlugin::class.java)
    dependencies {
        add("rewrite", "org.openrewrite.recipe:rewrite-java-dependencies:latest.release")
    }
    extensions.configure<org.openrewrite.gradle.RewriteExtension> {
        activeRecipe("com.yourorg.DependencyInsightExample")
        setExportDatatables(true)
    }
    afterEvaluate {
        if (repositories.isEmpty()) {
            repositories {
                mavenCentral()
            }
        }
    }
}

Run the recipe.

shell
gradle --init-script init.gradle.kts rewriteRun

You can add the plugin to your build.gradle file, so that it is available for all developers and CI/CD pipelines.

Add the following to your build.gradle file:

build.gradle
plugins {
    id("org.openrewrite.rewrite") version("latest.release")
}

rewrite {
    activeRecipe("com.yourorg.DependencyInsightExample")
    setExportDatatables(true)
}

repositories {
    mavenCentral()
}

dependencies {
    rewrite("org.openrewrite.recipe:rewrite-java-dependencies:latest.release")
}

Run gradle rewriteRun to run the recipe.

You can run OpenRewrite recipes directly from IntelliJ IDEA, after installing the OpenRewrite plugin.

After adding the rewrite.yml file shown above to your project, you should see a run icon in the left margin offering to run the recipe.

Analyze the Results

After running the recipe, you will find a data table for DependenciesInUse in a timestamped subdirectory under target/rewrite/datatables/ for Maven, or under build/ for Gradle, or in the output directory specified for the Moderne CLI. Compare the versions of dependencies in use with the Spring Boot 4 managed dependency versions to identify any discrepancies that may need to be addressed before upgrading. Dependencies to look out for include Hibernate, Jackson, Kafka, ElasticSearch, among others, all of which see major version updates in Spring Boot 4.

Analyze the Results​

Analyze the Results