Skip to main content

Upgrade transitive npm dependency

org.openrewrite.javascript.UpgradeTransitiveDependencyVersion

Pins or upgrades a transitive npm dependency by adding an override entry to package.json and regenerating the lock file. For npm and Bun, adds to the overrides field; for Yarn, adds to resolutions; for pnpm, adds to pnpm.overrides. The override is idempotent — if the entry already exists with the same version, no change is made. Not safe to use as a precondition: invokes the package manager and publishes per-project state shared with other dependency recipes.

Recipe source​

GitHub: UpgradeTransitiveDependencyVersion.java, Issue Tracker, Code Genome Project

This recipe is available under the Moderne Source Available License. Moderne customers can download precompiled artifacts from The Code Genome Project. For non-commercial use you can build the artifact from source locally.

Options​

TypeNameDescriptionExample
StringpackageNameThe name of the transitive npm dependency to upgrade.lodash
StringnewVersionThe version constraint to set on the override entry.^5.0.0
StringdependencyPathOptional. Optional dependency path (pnpm-style a>b>c or yarn-style a/b/c) to scope the override. When omitted, applies as a global override.express>accepts

Usage​

This recipe has required configuration parameters. Recipes with required configuration parameters cannot be activated directly (unless you are running them via the Moderne CLI). To activate this recipe you must create a new recipe which fills in the required parameters. In your rewrite.yml create a new recipe with a unique name. For example: com.yourorg.UpgradeTransitiveDependencyVersionExample. Here's how you can define and customize such a recipe within your rewrite.yml:

rewrite.yml
---
type: specs.openrewrite.org/v1beta/recipe
name: com.yourorg.UpgradeTransitiveDependencyVersionExample
displayName: Upgrade transitive npm dependency example
recipeList:
  - org.openrewrite.javascript.UpgradeTransitiveDependencyVersion:
      packageName: lodash
      newVersion: ^5.0.0
      dependencyPath: express>accepts

This recipe has no required configuration parameters and comes from a rewrite core library. It can be activated directly without adding any dependencies.

Now that com.yourorg.UpgradeTransitiveDependencyVersionExample has been defined, activate it in your build file:

OpenRewrite artifacts are distributed through the Code Genome Project repository (https://artifacts.codegenomeproject.org/maven), which requires authentication. Sign in to the Code Genome Project to create a download token, then in the snippets below replace USERNAME with the email or username you signed in with and TOKEN with that token. See the quickstart guide for details.

  1. Add the following to your build.gradle file:
    build.gradle
    plugins {
        id("org.openrewrite.rewrite") version("latest.release")
    }

    rewrite {
        activeRecipe("com.yourorg.UpgradeTransitiveDependencyVersionExample")
        setExportDatatables(true)
    }

    repositories {
        mavenCentral()
        maven {
            url = "https://artifacts.codegenomeproject.org/maven"
            credentials {
                username = "USERNAME"
                password = "TOKEN"
            }
        }
    }
  2. Run gradle rewriteRun to run the recipe.

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Node.js lock regeneration failures​

org.openrewrite.javascript.table.NodeLockRegenerationFailures

Lock files that could not be regenerated after a dependency edit, and why.

Column NameDescription
Source pathThe path of the package.json whose lock could not be regenerated.
Package nameThe package that caused the failure, when attributable to one.
ReasonThe structured failure reason, e.g. REGISTRY_UNREACHABLE or RESOLUTION_REQUIRED. Absent for unstructured failures.
DetailA human-readable description of the failure.