Respect overrideTransitive=false in DependencyVulnerabilityCheck

openrewrite · Dec 5, 2024 · b61703e · b61703e
1 parent adabc83
commit b61703e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/main/java/org/openrewrite/java/dependencies/DependencyVulnerabilityCheck.java b/src/main/java/org/openrewrite/java/dependencies/DependencyVulnerabilityCheck.java
@@ -264,7 +264,7 @@ public TreeVisitor<?, ExecutionContext> getVisitor(Accumulator acc) {
                             .getVisitor(acc.getDependencyAcc())
                             .visitNonNull(t, ctx);
                     String because = null;
-                    if (t2 == t) {
+                    if (t2 == t && overrideTransitive != null && overrideTransitive) {
                         because = because(vulnerabilities);
                         t2 = new UpgradeTransitiveDependencyVersion(gav.getGroupId(), gav.getArtifactId(), versionToRequest, scope, null, null, null, because, null, null, true)
                                 .getVisitor(acc.getTransitiveAcc())