Upgrade maven-pmd-plugin as part of the Java 17 migration - #1208
Merged
Merged
Conversation
Move the `maven-pmd-plugin` upgrade from `UpgradePluginsForJava25` to `UpgradePluginsForJava17`, so that anyone landing on Java 17 or later picks up PMD parser and analyzer fixes. `UpgradeToJava25` chains through `UpgradeToJava21` and `UpgradeToJava17`, so the Java 25 floor of 3.28.x remains covered by the floating `3.x` version.
mergify Bot
added a commit
to robfrank/linklift
that referenced
this pull request
Sep 6, 2026
…42.0 to 3.42.1 [skip ci] Bumps [org.openrewrite.recipe:rewrite-migrate-java](https://github.com/openrewrite/rewrite-migrate-java) from 3.42.0 to 3.42.1. Release notes *Sourced from [org.openrewrite.recipe:rewrite-migrate-java's releases](https://github.com/openrewrite/rewrite-migrate-java/releases).* > v3.42.1 > ------- > > What's Changed > -------------- > > * Do not duplicate JSpecify annotations when several annotations map to one by [`@timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-migrate-java#1200](https://redirect.github.com/openrewrite/rewrite-migrate-java/pull/1200) > * Upgrade `maven-pmd-plugin` as part of the Java 17 migration by [`@timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-migrate-java#1208](https://redirect.github.com/openrewrite/rewrite-migrate-java/pull/1208) > * Update inline Guava recipes for Guava 33.7.0 by [`@timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-migrate-java#1207](https://redirect.github.com/openrewrite/rewrite-migrate-java/pull/1207) > * Extend `UseListOf` prose pattern to `LinkedHashSet` by [`@timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-migrate-java#1209](https://redirect.github.com/openrewrite/rewrite-migrate-java/pull/1209) > > **Full Changelog**: <openrewrite/rewrite-migrate-java@v3.42.0...v3.42.1> Commits * [`c5ef164`](openrewrite/rewrite-migrate-java@c5ef164) Extend `UseListOf` prose pattern to `LinkedHashSet` ([#1181](https://redirect.github.com/openrewrite/rewrite-migrate-java/issues/1181)) ([#1209](https://redirect.github.com/openrewrite/rewrite-migrate-java/issues/1209)) * [`57c644c`](openrewrite/rewrite-migrate-java@57c644c) Update inline Guava recipes for Guava 33.7.0 ([#1207](https://redirect.github.com/openrewrite/rewrite-migrate-java/issues/1207)) * [`4a91085`](openrewrite/rewrite-migrate-java@4a91085) Upgrade `maven-pmd-plugin` as part of the Java 17 migration ([#1208](https://redirect.github.com/openrewrite/rewrite-migrate-java/issues/1208)) * [`1cb4f8d`](openrewrite/rewrite-migrate-java@1cb4f8d) [Auto] SDKMAN! Java candidates as of 2026-08-17T1025 * [`75f07f7`](openrewrite/rewrite-migrate-java@75f07f7) Do not duplicate JSpecify annotations when several annotations map to one ([#1](https://redirect.github.com/openrewrite/rewrite-migrate-java/issues/1)... * See full diff in [compare view](openrewrite/rewrite-migrate-java@v3.42.0...v3.42.1) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's changed?
Moves the
maven-pmd-pluginupgrade fromUpgradePluginsForJava25toUpgradePluginsForJava17, using the floating3.xversion already used there formaven-checkstyle-plugin,maven-compiler-pluginandmaven-war-plugin.Since
UpgradeToJava25→UpgradeToJava21→UpgradeToJava17, the Java 25 floor of3.28.xstays covered; keeping both entries would just be two sources of truth for the same plugin, with the pin being the lower of the two.What's your motivation?
Reported by a customer running the Spring Boot 4 migration (which pulls in
UpgradeToJava17): they still had to hand-bumpmaven-pmd-plugin3.24.0 → 3.28.0 afterwards to get past aStackOverflowErrorin PMD. Pinning the bump to the Java 25 recipe only catches folks going all the way to 25; floating it at the Java 17 level catches PMD parser and analyzer fixes for everyone landing on Java 17 or later.Anything in particular you'd like reviewers to focus on?
maven-pmd-plugin3.22.0 switched from PMD 6.55 to PMD 7.0, so projects still pinned below 3.22 get a major analyzer change: PMD 7 renamed/removed rules and dropped the oldrulesets/java/*.xmlpaths, so custom rulesets can fail to load andpmd:checkcan newly fail.UpgradePluginVersionhas no way to gate on "only if current >= 3.22", and themaven-checkstyle-plugin: 3.xentry already in this recipe accepts the same class of risk, so this seems acceptable — but worth a second opinion.Compatibility checked: 3.28.0 still declares
<javaVersion>8</javaVersion>and<prerequisites><maven>3.6.3</maven></prerequisites>, so no new build floor is imposed.