Jitpack repository retrieved wrong version of dependency

Question

I tried to use JitPack to add a forked library to my Android project.

allprojects {
    repositories {
        jcenter()
        google()
        maven { url 'https://jitpack.io'}
    }
}

After sync, my library was added correctly, but the problem is, the newest version of dependencies like Picasso and okio was retrieved, other than the version specified in gradle file.

implementation 'com.squareup.okio:okio:1.9.0'
implementation 'com.squareup.picasso:picasso:2.5.2'

Also tried to use includeGroup to only retrieve my own library via JitPack, but it still get the newest packages somehow.

maven { url 'https://jitpack.io'
            content {
                includeGroupByRegex "com\\.github\\.myusername.*"
            }}

I assume it's a maven repository problem but don't really understand what's going on. Any suggestion is welcomed!

Yes, a bunch of androidx packages, firebase, and others. But they are fine since they are using newest version anyway. — Selkie, Sep 10 '19 at 16:21
Run the `app:dependencies` or `app:dependencyInsight`. Some of other dependencies can have a transitive dependency on the newest version. Gradle in this case downloads only the newest versions and not the version specified in build.gradle — Gabriele Mariotti, Sep 10 '19 at 16:29
You are right. The library I forked use `picasso` and `okio` as dependencies. Thanks for the advice! — Selkie, Sep 13 '19 at 15:06

score 0 · Answer 1 · answered Jan 21 '21 at 20:20

Maven dependencies are specified as

groupid:artifact:version

On most Maven repositories, they are taken from the pom.xml of the library.

JitPack works differently here:

the groupid identifies the git hosting service and user, e.g. com.gitlab.johndoe
artifact is the project name on that git hosting service, as found in the URL
version is a git ref, i.e. a tag or branch name, or a commit hash

There are ways to keep these in sync:

for the domain that corresponds to your groupid, configure a TXT record with a URL which points to the corresponding user or organization at the git hoster
choose the artifact name and project name to be the same
tag each release in git with the version number it has in pom.xml.

Otherwise, you will have to modify your dependencies so JitPack will find them.

Jitpack repository retrieved wrong version of dependency

1 Answers1