Bump org.openrewrite.recipe:rewrite-recipe-bom from 3.26.1 to 3.38.0 by dependabot[bot] · Pull Request #1557 · apache/wicket

dependabot · 2026-08-30T02:15:01Z

Bumps org.openrewrite.recipe:rewrite-recipe-bom from 3.26.1 to 3.38.0.

Release notes

Sourced from org.openrewrite.recipe:rewrite-recipe-bom's releases.

3.38.0

What's Changed

Incorporates the latest versions of OpenRewrite (v8.91.0), the rewrite-gradle-plugin (v7.41.0), and the rewrite-maven-plugin (v6.47.0) to improve code parsing accuracy and recipe execution reliability.

Full Changelog: openrewrite/rewrite-recipe-bom@v3.37.0...v3.38.0

3.37.0

What's Changed

Incorporates the latest versions of OpenRewrite (v8.89.0), the rewrite-gradle-plugin (v7.39.0), and the rewrite-maven-plugin (v6.46.1) to improve code parsing accuracy and recipe execution reliability.

Full Changelog: openrewrite/rewrite-recipe-bom@v3.36.0...v3.37.0

3.36.0

What's Changed

Incorporates the latest versions of OpenRewrite (v8.88.0), the rewrite-gradle-plugin (v7.38.0), and the rewrite-maven-plugin (v6.45.0) to improve code parsing accuracy and recipe execution reliability.

Full Changelog: openrewrite/rewrite-recipe-bom@v3.35.0...v3.36.0

3.35.0

What's Changed

Incorporates the latest versions of OpenRewrite (v8.87.0), the rewrite-gradle-plugin (v7.37.0), and the rewrite-maven-plugin (v6.44.0) to improve code parsing accuracy and recipe execution reliability.

Full Changelog: openrewrite/rewrite-recipe-bom@v3.34.0...v3.35.0

3.34.0

What's Changed

Incorporates the latest versions of OpenRewrite (v8.86.0), the rewrite-gradle-plugin (v7.36.0), and the rewrite-maven-plugin (v6.43.0) to improve code parsing accuracy and recipe execution reliability.

Full Changelog: openrewrite/rewrite-recipe-bom@v3.33.0...v3.34.0

3.33.0

What's Changed

Incorporates the latest versions of OpenRewrite (v8.85.0), the rewrite-gradle-plugin (v7.35.0), and the rewrite-maven-plugin (v6.42.0) to improve code parsing accuracy and recipe execution reliability.

Full Changelog: openrewrite/rewrite-recipe-bom@v3.32.0...v3.33.0

3.32.0

What's Changed

Incorporates the latest versions of OpenRewrite (v8.84.0), the rewrite-gradle-plugin (v7.34.0), and the rewrite-maven-plugin (v6.41.0) to improve code parsing accuracy and recipe execution reliability.

Full Changelog: openrewrite/rewrite-recipe-bom@v3.31.0...v3.32.0

3.31.0

... (truncated)

Commits

f4d6057 Drop the Gradle Plugin Portal repository so org.openrewrite:plugin resolves f...
f6c1445 Pass the renamed CODEGENOME_USERNAME/TOKEN secrets to gh-automation (#65)
616948f Run the scheduled build after the repos it aggregates (#64)
86d9c01 Drop rewrite-codemods from the BOM (#63)
70b4355 Resolve dependencies from the Code Genome Project (#62)
b7f6177 Exclude jgit from checkBomAlignment (#60)
4af1dea Manage org.openrewrite.tools:jgit-gpg-bc in the BOM (#59)
6ee6c76 Renew and reclassify OWASP suppressions; suppress jna and netty CVE-2026-5681...
547c273 Remove Maven Central badges from README files
1836a5a Publish rewrite-recipe-bom to the Code Genome Project (#57)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [org.openrewrite.recipe:rewrite-recipe-bom](https://github.com/openrewrite/rewrite-recipe-bom) from 3.26.1 to 3.38.0. - [Release notes](https://github.com/openrewrite/rewrite-recipe-bom/releases) - [Commits](openrewrite/rewrite-recipe-bom@v3.26.1...v3.38.0) --- updated-dependencies: - dependency-name: org.openrewrite.recipe:rewrite-recipe-bom dependency-version: 3.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

solomax · 2026-09-14T02:46:16Z

@ALL

org.openrewrite requires login/password and doesn't hosted at maven central anymore (https://docs.openrewrite.org/running-recipes/getting-started)

bitstorm · 2026-10-08T07:34:03Z

@ALL

org.openrewrite requires login/password and doesn't hosted at maven central anymore (https://docs.openrewrite.org/running-recipes/getting-started)

That's such a pain in the ass. Our current version is not compatible with Java 27.

martin-g · 2026-10-08T08:31:37Z

Let me try to fix it!

martin-g · 2026-10-08T09:02:57Z

@timtebeek Could you please help us here ?
I've added Github Action secrets for CodeGenome. Many OpenRewrite dependencies are successfully downloaded from https://artifacts.codegenomeproject.org/maven/org/openrewrite/... but just these three fail with error 403:

[ERROR] Failed to execute goal on project wicket-migration: Could not resolve dependencies for project org.apache.wicket:wicket-migration:jar:11.0.0-SNAPSHOT
[ERROR] dependency: org.openrewrite.recipe:rewrite-github-actions:jar:3.30.0 (runtime)
[ERROR] 	Could not transfer artifact org.openrewrite.recipe:rewrite-github-actions:jar:3.30.0 from/to codegenome (https://artifacts.codegenomeproject.org/maven): status code: 403, reason phrase: Forbidden (403)
[ERROR] 	Could not find artifact org.openrewrite.recipe:rewrite-github-actions:jar:3.30.0 in central (https://repo.maven.apache.org/maven2)
[ERROR] dependency: org.openrewrite.recipe:rewrite-joda:jar:0.10.2 (runtime)
[ERROR] 	Could not transfer artifact org.openrewrite.recipe:rewrite-joda:jar:0.10.2 from/to codegenome (https://artifacts.codegenomeproject.org/maven): status code: 403, reason phrase: Forbidden (403)
[ERROR] 	Could not find artifact org.openrewrite.recipe:rewrite-joda:jar:0.10.2 in central (https://repo.maven.apache.org/maven2)
[ERROR] dependency: org.openrewrite.recipe:rewrite-jenkins:jar:0.37.2 (runtime)
[ERROR] 	Could not transfer artifact org.openrewrite.recipe:rewrite-jenkins:jar:0.37.2 from/to codegenome (https://artifacts.codegenomeproject.org/maven): status code: 403, reason phrase: Forbidden (403)
[ERROR] 	Could not find artifact org.openrewrite.recipe:rewrite-jenkins:jar:0.37.2 in central (https://repo.maven.apache.org/maven2)
[ERROR]

I can see it at https://artifacts.codegenomeproject.org/maven/org/openrewrite/recipe/rewrite-github-actions/3.30.0/

It looks like a file system access permissions issue to me.

timtebeek · 2026-10-08T09:40:48Z

Thanks for the tag @martin-g and sorry to hear about your troubles. It's indeed an access permission issue. The CGP offers free downloads for any Apache licensed modules, but the three you've referenced fall under Moderne Source Available License: https://docs.moderne.io/user-documentation/recipes/accessing-the-code-genome-project/#what-the-repository-hosts
Those modules are still source available for folks to build and run within the terms of the license, but we don't offer binaries for those to non-customers, which is tripping you up here.

Looking across which recipes are used & pulled in here they seem to come in through these two

wicket/wicket-migration/src/main/resources/META-INF/rewrite/wicket.yml

Lines 17 to 18 in 003cf99

    
           - org.openrewrite.java.migrate.UpgradeToJava17 
        
           - org.openrewrite.java.migrate.jakarta.JavaxMigrationToJakarta

That brings us to a few different ways forward:

Pin to an older version of either the bom, or the specific recipe modules; not ideal, but the quickest way forward for now. Note that you'll want to use rewrite-recipe-bom:3.37.0 for the latest version on Maven Central for the recipe modules. The 3.38.0 release should not have gone to Central.
Take out the MSAL licensed recipes and modules here; users can still procure and run those MSAL recipes themselves, making this purely handle the Wicket side of the migration. Others like Quarkus have opted for this approach as well, depending only on our Apache licensed modules.

I understand neither is ideal from a user perspective, but it's what I can offer based on decisions beyond my control.

martin-g · 2026-10-08T11:03:49Z

Thanks for your quick response, @timtebeek !

Open-Rewrite is a cool idea but the decisions taken and the implementation is not good!
So, OSS modules depend on paid ones and the users have to figure it out...

I've added exclusions for the problematic modules and now the build fails with dependency convergence errors:

[ERROR] Rule 1: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed with message:
[ERROR] Failed while enforcing releasability.
[ERROR]
[ERROR] Dependency convergence error for org.jetbrains.kotlin:kotlin-reflect:jar:1.6.10. Paths to dependency are:
[ERROR] +-org.apache.wicket:wicket-migration:jar:11.0.0-SNAPSHOT
[ERROR]   +-org.openrewrite.recipe:rewrite-migrate-java:jar:3.26.0:compile
[ERROR]     +-org.openrewrite:rewrite-gradle:jar:8.91.0:runtime
[ERROR]       +-org.openrewrite:rewrite-kotlin:jar:8.91.0:runtime
[ERROR]         +-org.jetbrains.kotlin:kotlin-compiler-embeddable:jar:2.4.10:runtime
[ERROR]           +-org.jetbrains.kotlin:kotlin-reflect:jar:1.6.10:runtime
[ERROR] and
[ERROR] +-org.apache.wicket:wicket-migration:jar:11.0.0-SNAPSHOT
[ERROR]   +-org.openrewrite.recipe:rewrite-migrate-java:jar:3.26.0:compile
[ERROR]     +-org.openrewrite:rewrite-gradle:jar:8.91.0:runtime
[ERROR]       +-org.openrewrite:rewrite-kotlin:jar:8.91.0:runtime
[ERROR]         +-org.jetbrains.kotlin:kotlin-reflect:jar:2.4.10:runtime
[ERROR]
[ERROR]
[ERROR] Dependency convergence error for org.jspecify:jspecify:jar:1.0.1. Paths to dependency are:
[ERROR] +-org.apache.wicket:wicket-migration:jar:11.0.0-SNAPSHOT
[ERROR]   +-org.openrewrite.recipe:rewrite-migrate-java:jar:3.26.0:compile
[ERROR]     +-org.openrewrite:rewrite-java:jar:8.91.0:runtime
[ERROR]       +-org.openrewrite:rewrite-core:jar:8.91.0:runtime
[ERROR]         +-org.jspecify:jspecify:jar:1.0.1:runtime
[ERROR] and
[ERROR] +-org.apache.wicket:wicket-migration:jar:11.0.0-SNAPSHOT
[ERROR]   +-org.openrewrite.recipe:rewrite-migrate-java:jar:3.26.0:compile
[ERROR]     +-org.openrewrite:rewrite-java:jar:8.91.0:runtime
[ERROR]       +-io.micrometer:micrometer-core:jar:1.17.0:test
[ERROR]         +-org.jspecify:jspecify:jar:1.0.0:test
[ERROR] and
[ERROR] +-org.apache.wicket:wicket-migration:jar:11.0.0-SNAPSHOT
[ERROR]   +-org.openrewrite.recipe:rewrite-migrate-java:jar:3.26.0:compile
[ERROR]     +-org.openrewrite:rewrite-java:jar:8.91.0:runtime
[ERROR]       +-io.micrometer:micrometer-core:jar:1.17.0:test
[ERROR]         +-io.micrometer:micrometer-commons:jar:1.17.0:test
[ERROR]           +-org.jspecify:jspecify:jar:1.0.0:test
...

This has always been a pain with openrewrite updates in Wicket.

Lately a LLM agent does pretty good job in helping with migrations, so based on the problems above my opinion is that wicket-migration module should be removed for Wicket 11 and documented as deprecated for Wicket 10.

timtebeek · 2026-10-08T13:22:44Z

Thanks for your quick response, @timtebeek !

Of course, trying to help as best I can.

So, OSS modules depend on paid ones and the users have to figure it out...

No we very strictly only have dependencies pointing from proprietary & source available modules to the Apache licensed modules. None of that has changed; the modules you're depending on just aren't Apache licensed, but were on Maven Central all the same. You can see the full list of licensed on https://docs.openrewrite.org/reference/latest-versions-of-every-openrewrite-module

I've added exclusions for the problematic modules and now the build fails with dependency convergence errors:

Hmm, that listing shows you still use rewrite-migrate-java: 3.26.0 , which itself also falls under MSAL, and has fallen behind even by what was last pushed to central: https://mvnrepository.com/artifact/org.openrewrite.recipe/rewrite-migrate-java

Lately a LLM agent does pretty good job in helping with migrations, so based on the problems above my opinion is that wicket-migration module should be removed for Wicket 11 and documented as deprecated for Wicket 10.

While I can't stop you there, I can say from our experience users will have the best results (in terms of performance, costs, and predicability) when doing as much as possible in a deterministic way, before handing off to LLMs. Something to consider, as these types of changes are mechanical:

wicket/wicket-migration/src/main/resources/META-INF/rewrite/wicket.yml

Lines 98 to 126 in 003cf99

    
           - org.openrewrite.java.ChangeType: 
        
               oldFullyQualifiedTypeName: org.apache.wicket.util.crypt.ICrypt 
        
               newFullyQualifiedTypeName: org.apache.wicket.core.util.crypt.ICrypt 
        
               ignoreDefinition: "True" 
        
           - org.openrewrite.java.ChangeType: 
        
               oldFullyQualifiedTypeName: org.apache.wicket.util.crypt.ICryptFactory 
        
               newFullyQualifiedTypeName: org.apache.wicket.core.util.crypt.ICryptFactory 
        
               ignoreDefinition: "True" 
        
           - org.openrewrite.java.ChangeType: 
        
               oldFullyQualifiedTypeName: org.apache.wicket.util.crypt.NoCrypt 
        
               newFullyQualifiedTypeName: org.apache.wicket.core.util.crypt.NoCrypt 
        
               ignoreDefinition: "True" 
        
           - org.openrewrite.java.ChangeType: 
        
               oldFullyQualifiedTypeName: org.apache.wicket.util.crypt.NoCryptFactory 
        
               newFullyQualifiedTypeName: org.apache.wicket.core.util.crypt.NoCryptFactory 
        
               ignoreDefinition: "True" 
        
           - org.openrewrite.java.ChangeType: 
        
               oldFullyQualifiedTypeName: org.apache.wicket.authroles.authentication.panel.SignInPanel 
        
               newFullyQualifiedTypeName: org.apache.wicket.authroles.authentication.panel.UsernamePasswordPanel 
        
               ignoreDefinition: "True" 
        
           - org.openrewrite.java.ChangeType: 
        
               oldFullyQualifiedTypeName: org.apache.wicket.authroles.authentication.pages.SignInPage 
        
               newFullyQualifiedTypeName: org.apache.wicket.authroles.authentication.pages.UsernamePasswordPage 
        
               ignoreDefinition: "True" 
        
           - org.openrewrite.maven.UpgradeDependencyVersion: 
        
               groupId: org.apache.wicket 
        
               artifactId: "*" 
        
               newVersion: 11.x 
        
               versionPattern: -SNAPSHOT

If you still choose to drop the module I'd understand; thanks for working with us so far and all the best going forward. ❤️

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 30, 2026

dependabot Bot mentioned this pull request Aug 30, 2026

Bump org.openrewrite.recipe:rewrite-recipe-bom from 3.26.1 to 3.37.0 #1542

Closed

Add setup for CodeGenome Maven repo (needed for open-rewrite)

5a57a2c

Navigation Menu

Repository navigation

Bump org.openrewrite.recipe:rewrite-recipe-bom from 3.26.1 to 3.38.0 - #1557

Bump org.openrewrite.recipe:rewrite-recipe-bom from 3.26.1 to 3.38.0#1557
dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/maven/org.openrewrite.recipe-rewrite-recipe-bom-3.38.0

dependabot Bot commented on behalf of github Aug 30, 2026 •

edited

Loading

Uh oh!

solomax commented Sep 14, 2026

Uh oh!

bitstorm commented Oct 8, 2026

Uh oh!

martin-g commented Oct 8, 2026

Uh oh!

martin-g commented Oct 8, 2026 •

edited

Loading

Uh oh!

timtebeek commented Oct 8, 2026

Uh oh!

martin-g commented Oct 8, 2026

Uh oh!

timtebeek commented Oct 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

dependabot Bot commented on behalf of github Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.38.0

What's Changed

3.37.0

What's Changed

3.36.0

What's Changed

3.35.0

What's Changed

3.34.0

What's Changed

3.33.0

What's Changed

3.32.0

What's Changed

3.31.0

Uh oh!

solomax commented Sep 14, 2026

Uh oh!

bitstorm commented Oct 8, 2026

Uh oh!

martin-g commented Oct 8, 2026

Uh oh!

martin-g commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

timtebeek commented Oct 8, 2026

Uh oh!

martin-g commented Oct 8, 2026

Uh oh!

timtebeek commented Oct 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dependabot Bot commented on behalf of github Aug 30, 2026 •

edited

Loading

martin-g commented Oct 8, 2026 •

edited

Loading