App Advisor CLI Falsely Reports "Up to Date" for Dependency Versions Pinned in an External Parent BOM

Products

• VMware Tanzu Spring Essentials

Issue/Introduction

When using the Tanzu App Advisor CLI to generate an upgrade plan or apply patches to a Maven project, the tool may falsely report that the project is completely up to date, skipping available patch upgrades.

Users will see output similar to the following in their CLI or verbose logs:

Applying patch upgrades... [00m 08s] ok
All dependencies are up to date. No new patches available.

This false negative occurs despite the availability of newer upstream patches (e.g., for Spring Framework or Spring Boot) within the commercial repository.

 

Environment

App Advisor CLI 

Tanzu Platform

Tanzu Spring 

Cause

This issue is caused by a Maven reactor-scoping limitation combined with a known defect in how the broader App Advisor recipe set handles pom-packaged projects.

The advisor patch apply and advisor upgrade-plan commands only evaluate dependency versions reachable through the active Maven reactor. If the project's dependency versions are pinned in a parent BOM that sits outside the reactor (referenced only via a <parent> or <relativePath> tag), those versions are invisible to the tool. Consequently, the CLI reports the project as "up to date."

Attempting to run the full advisor patch apply command directly against the isolated BOM project triggers a known defect where the tool may incorrectly inject unrelated dependencies into a new <dependencyManagement> block.

Resolution

To bypass this issue safely, you must manually run a targeted OpenRewrite dependency upgrade recipe directly against the isolated BOM, and then run the standard App Advisor command against your main project.

You must use the plain org.openrewrite.maven.UpgradeDependencyVersion recipe for this step. Do not use the full App Advisor "patch apply" recipe set against the BOM, as it may incorrectly alter the file.

Follow these steps to apply the workaround:

1. Navigate to the directory of your isolated BOM project (where its pom.xml resides).

2. Create a file named rewrite.yml in this directory with the following contents:

---
type: specs.openrewrite.org/v1beta/recipe
name: com.cpf.BomPatchUpgrade
recipeList: 
  - org.openrewrite.maven.UpgradeDependencyVersion: 
      groupId: "*"
      artifactId: "*"
      newVersion: latest.patch
      overrideManagedVersion: true

3. Preview the changes by running a dry run. Ensure your <settings.xml> contains your Spring commercial repository credentials, as the version check requires access to see commercial patch lines:

mvn -s <path-to-your-settings.xml> org.openrewrite.maven:rewrite-maven-plugin:6.44.0:dryRun \
  -Drewrite.configLocation=rewrite.yml \
  -Drewrite.activeRecipes=com.cpf.BomPatchUpgrade

4. Review the generated target/rewrite/rewrite.patch file to ensure the intended version bumps are correct.

5. Apply the changes directly to the BOM by running:

mvn -s <path-to-your-settings.xml> org.openrewrite.maven:rewrite-maven-plugin:6.44.0:run \
  -Drewrite.configLocation=rewrite.yml \
  -Drewrite.activeRecipes=com.cpf.BomPatchUpgrade

6. Navigate back to your main project reactor.

7. Run your advisor patch apply or advisor upgrade-plan get commands as normal. The main reactor will now successfully inherit the upgraded versions from the patched BOM.

If you have multiple external BOMs or parent POMs following this pattern, repeat steps 1 through 5 for each one before running the advisor against the main reactor.