Maven dependency analyzer automatic cleanup

[simoneromani-90]

Hello,
I am currently busy keeping up with LCM and upgrade our dependencies. One solution that was proposed to me was using Dependabot, but I also realized that I have way too many dependencies in my pom.xml (I use Maven) and I am probably not using them a good 15% of them. Upgrading dependencies that I don't really use will only waste my time in code review.

I looked around the internet for automated processes that remove unused dependencies, add undeclared dependencies and move non-test scoped to the test-scoped, but I couldn't find anything. So I thought of OpenRewrite!

I am using OpenRewrite for other LCM tasks, like migrating to JUnit5 or Assertj, and there is a lot of Maven recipes already available, but I feel like there is a lot of potential to automate the process of mvn dependency:analyze via an OpenRewrite recipe.

Do you also see the potential? Would it actually be feasible to create a recipe like that?

[timtebeek]

hi! Yes we've put some work towards this at Moderne, resulting in the following (proprietary) recipe:
https://docs.openrewrite.org/recipes/java/dependencies/removeunuseddependencies

This recipe was built over the span of two live streaming sessions, in case you're interested to follow along:

• https://www.youtube.com/watch?v=LeXgFhU9wT4
• https://www.youtube.com/watch?v=TMjpc-a1qN4

I hope that's helpful to you still, even if access to that recipe requires a relationship with Moderne.

[simoneromani-90]

Could this be extended to also add dependencies that are used but not declared? Maybe create a separate recipe and create a super recipe containing these two

[timtebeek]

That would definitely be an option, yes; We know for all types where they are coming from, and we know which direct dependencies the project has. From there it should be straightforward to add any missing dependencies as direct dependencies. Feel free to log an issue if that's desired!

[simoneromani-90]

Now that I'm about to write down an issue, I'm considering what could be the drawback of potentially introducing a lot of changes in the codebase and then having a hard time finding the culprit if something gets broken in integration testing phase. I've seen that happening before and I have chatted with some colleagues which they would prefer to still do it manually and incrementally to keep control over the changes. Maybe we could ask the community here if they also see value in this recipe?