[rewrite-maven] Dependency scope is Compile and Runtime rather than just Runtime

[BoykoAlex]

The issue uncovered while upgrading spring-petclinic from Spring Boot 2.7 to Spring Boot 3.0

Consider spring-petclinic from https://github.com/BoykoAlex/spring-petclinic/tree/2.7.x (i.e. branch 2.7.x

Upgrade it to spring boot 3.0. Note compiler errors for unresolved jakarta.xml in Vet and Vets classes. This is due to the missing jakarta.xml.bind-api dependency in the pom. The recipe org.openrewrite.java.migrate.jakarta.JavaxXmlBindMigrationToJakartaXmlBind from rewrite-migrate-java was supposed to add the dependency.

The issue seems to be coming from the fact that MavenResolutionResult for petclinic pom resolution has jakarta.xml.bind-api not only under Runtime scope (correct) but also under the Compile scope (wrong).

Therefore I have raised the issue against rewrite-maven

Unit test to paste into AddDependencyTest class in rewrite-maven:

    @Test
    void noCompileScopeDependency() {
        rewriteRun(
          spec -> spec.recipe(addDependency("jakarta.xml.bind:jakarta.xml.bind-api:latest.release", "com.google.common.math.IntMath", true)),
          mavenProject(
            "project",
            srcMainJava(
              java(usingGuavaIntMath)
            ),
            pomXml(
              """
                    <project>
                      <modelVersion>4.0.0</modelVersion>
                      <groupId>org.springframework.samples</groupId>
                      <artifactId>spring-petclinic</artifactId>
                      <version>2.7.3</version>
                    
                      <parent>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-starter-parent</artifactId>
                        <version>3.0.5</version>
                      </parent>
                      <name>petclinic</name>
                    
                      <properties>
                        <jakarta-servlet.version>5.0.0</jakarta-servlet.version>
                    
                        <java.version>17</java.version>
                        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
                        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
                    
                        <webjars-bootstrap.version>5.1.3</webjars-bootstrap.version>
                        <webjars-font-awesome.version>4.7.0</webjars-font-awesome.version>
                    
                        <jacoco.version>0.8.8</jacoco.version>
                    
                      </properties>
                    
                      <dependencies>
                        <dependency>
                          <groupId>org.springframework.boot</groupId>
                          <artifactId>spring-boot-starter-data-jpa</artifactId>
                        </dependency>
                      </dependencies>
                    
                    </project>
                """,
              """
                    <project>
                      <modelVersion>4.0.0</modelVersion>
                      <groupId>org.springframework.samples</groupId>
                      <artifactId>spring-petclinic</artifactId>
                      <version>2.7.3</version>
                    
                      <parent>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-starter-parent</artifactId>
                        <version>3.0.5</version>
                      </parent>
                      <name>petclinic</name>
                    
                      <properties>
                        <jakarta-servlet.version>5.0.0</jakarta-servlet.version>
                    
                        <java.version>17</java.version>
                        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
                        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
                    
                        <webjars-bootstrap.version>5.1.3</webjars-bootstrap.version>
                        <webjars-font-awesome.version>4.7.0</webjars-font-awesome.version>
                    
                        <jacoco.version>0.8.8</jacoco.version>
                    
                      </properties>
                    
                      <dependencies>
                        <dependency>
                          <groupId>jakarta.xml.bind</groupId>
                          <artifactId>jakarta.xml.bind-api</artifactId>
                        </dependency>
                        <dependency>
                          <groupId>org.springframework.boot</groupId>
                          <artifactId>spring-boot-starter-data-jpa</artifactId>
                        </dependency>
                      </dependencies>
                    
                    </project>
                """
            )
          )
        );
    }

cc: @timtebeek, @sambsnyd

[BoykoAlex]

@timtebeek and @sambsnyd I have added unit test that reproduces the problem. Essentially jakarta.xml.bind-api iends up being Compile scope dependency but should only be Runtime scope dependency and hence should be added but is not added :-\ M2E in Eclipse show jakarta.xml.bind-api as a Runtime dependency as well...

[BoykoAlex]

I have simplified the unit test. Looks like dependency management scope for xml.bind-api is Compile scope for some reason and this makes it think that dependency is on the classpath :-\

[BoykoAlex]

Seems to me that the issue here is that if BOM (dependency management) does not have a scope specified then the scope is what specified for the project or iherited from the parent dependency scope. I think rewrite-maven behaviour is at fault by assuming that the scope of a BOM dependency is Compile scope if not specified... This seems wrong... scope should remain null in this case and if null should be detrmined from either parent dependency scope or the scope that is specified. Currently BOM scope overrides whatever is specified for the project...
(See gradle/gradle#10878)

[sambsnyd]

@BoykoAlex I merged your other PR, does that address this? Looks related

[BoykoAlex]

PR #3097 fixes this issue :-)