Why does bringing in a sibling module change the dependency rules/order of that module in gradle 5?

Question

I have two modules:

base-lib
service

The base-lib has some Spring Boot/Security dependencies as well as some Azure ones. The Azure one needs a specific version of nimbusds so I have that dependency set to a specific version (5.64.4). When I build that first module by itself, gradle only downloads 5.64.4. But when I include it as a project dependency of the other module (which has no other dependencies), then it downloads two versions: 5.64.4 and 6.0. Why would this be different?

base-lib: build.gradle

buildscript {

    repositories {
        mavenCentral()
        mavenLocal()
    }
    dependencies {
        classpath("org.springframework.boot:spring-boot-gradle-plugin:${springBootVersion}")
    }
}

apply plugin: "java"
apply plugin: "java-library"
apply plugin: "org.springframework.boot"
apply plugin: "io.spring.dependency-management"

group "${group}"
version "${version}"

sourceCompatibility = 11.0

repositories {
    mavenCentral()
    mavenLocal()
}

dependencies {

    api( [ "com.nimbusds:oauth2-oidc-sdk:5.64.4" ] )

    /* These are what pulls in 6.0 */
    api( [ "org.springframework.boot:spring-boot-starter-security:${springBootVersion}" ] )
    api( [ "org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure:${springBootVersion}" ] )
    api( [ "org.springframework.security:spring-security-oauth2-client:${springOAuthClientVersion}" ] )

    //Microsoft Azure AD
    api( [ "com.microsoft.azure:adal4j:${adal4jVersion}" ] )

    /* elided, lot's of other dependencies here */
}

service build.gradle

dependencies {
    implementation project(":base-lib")
}

If I delete the second module (service) and build the first, then it only downloads 5.64.4. But the moment I have both and build them, it pulls down 6.0 too.

This fixes it, but why is this needed when pulling in as a project dependenency and not normally? Why are the dependency rules different?

api( [ "com.nimbusds:oauth2-oidc-sdk:5.64.4" ] ) {
    force = true
}

score 1 · Accepted Answer · answered Dec 20 '18 at 18:46

The best way to trouble shoot such an issue is to use the dependencyInsight task on the problematic dependency.

In your case, the most likely explanation is that your project base-lib makes use of the Spring boot and Spring dependency management plugins. These plugins will force a number of versions according to the Spring boot BOM but also have a feature that makes any dependency declared with a version override what's coming from the BOM. And since you specify the version of oauth2-oidc-sdk it indeed gets that version.

Now when you pull transitively all these dependencies in service, the dependency management plugin is not applied. And thus default Gradle resolution rules apply, which means that between the 5.64.4 and 6.0 versions, Gradle will pick the highest.

Fixing can be done by forcing the version as you experimented or by applying the same plugins and declaring it again.

Why does bringing in a sibling module change the dependency rules/order of that module in gradle 5?

1 Answers1