Gradle ChangeDependency leaves an unversioned dependency when the new coordinates are unmanaged

[timtebeek]

What version of OpenRewrite are you using?

Latest main (560b40c).

What is the smallest, simplest way to reproduce the problem?

The Gradle org.openrewrite.gradle.ChangeDependency leaves a renamed dependency without a version whenever the declaration had no version of its own, even when a newVersion is supplied. This is currently asserted by ChangeDependencyTest#doNotPinWhenNotVersioned:

plugins {
  id 'java'
  id 'org.springframework.boot' version '2.6.1'
  id 'io.spring.dependency-management' version '1.0.11.RELEASE'
}
dependencies {
    runtimeOnly 'mysql:mysql-connector-java'   // -> 'com.mysql:mysql-connector-j'
}

Spring Boot 2.6.1 manages mysql:mysql-connector-java but not com.mysql:mysql-connector-j, so the resulting build script does not resolve. overrideManagedVersion is the documented escape hatch, and its own option description says "No check is done on the NEW dependency to verify if it is managed, it relies on whether the OLD dependency had a managed version."

• The Maven side behaves the other way round: it writes an explicit version when it can tell that the new coordinates are unmanaged (ChangeDependencyGroupIdAndArtifactIdTest#managedToUnmanagedExternalizedDepMgmt), and after ChangeDependency renames a managed dependency into unmanaged coordinates, leaving it without a version #8462 it declines to rename when it has no version to write.

What did you expect to see?

The Gradle recipe not producing a build script that cannot resolve, ideally matching the Maven decision.

What did you see instead?

An unversioned dependency on coordinates nothing manages.

The obstacle is that the GradleProject model does not record which versions come from dependency management, so "is the new GA managed?" cannot be answered the way ResolvedPom#getManagedVersion answers it for Maven. RemoveBomManagedDirectDependencies works around this by downloading each platform(...) POM and querying it, which covers platforms but not the io.spring.dependency-management plugin.

Are you interested in contributing a fix?

• Not immediately — filing to track the Maven/Gradle asymmetry uncovered while fixing ChangeDependency renames a managed dependency into unmanaged coordinates, leaving it without a version #8462.