Gradle 8.3 does not properly resolve exclusion

[jeffalder]

Current Behavior

With this build.gradle file:

plugins {
    id('java')
}

repositories {
    mavenCentral()
}

dependencies {
    implementation "io.dropwizard:dropwizard-jackson:4.0.2"
}

./gradlew compileJava fails

% ./gradlew cJ
> Task :compileJava FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':compileJava'.
> Could not resolve all files for configuration ':compileClasspath'.
   > Could not find com.google.code.findbugs:jsr305:.
     Required by:
         project : > io.dropwizard:dropwizard-jackson:4.0.2 > com.google.guava:guava:32.1.2-jre

Dropwizard has excluded jsr305 (https://github.com/dropwizard/dropwizard/blob/release/4.0.x/dropwizard-dependencies/pom.xml#L106-L111, https://central.sonatype.com/artifact/io.dropwizard/dropwizard-dependencies)

            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava</artifactId>
                <version>${guava.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>com.google.code.findbugs</groupId>
                        <artifactId>jsr305</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

And even though the dependency is listed in both guava and guava-parent.

% ./gradlew dependencies --configuration=runtimeClasspath

> Task :dependencies

------------------------------------------------------------
Root project 'test-guava-restrict'
------------------------------------------------------------

runtimeClasspath - Runtime classpath of source set 'main'.
\--- com.google.guava:guava:32.1.2-jre
     +--- com.google.guava:guava-parent:32.1.2-jre
     |    +--- com.google.code.findbugs:jsr305:3.0.2 (c)
     |    +--- org.checkerframework:checker-qual:3.33.0 (c)
     |    \--- com.google.errorprone:error_prone_annotations:2.18.0 (c)
     +--- com.google.guava:failureaccess:1.0.1
     +--- com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
     +--- com.google.code.findbugs:jsr305 -> 3.0.2
     +--- org.checkerframework:checker-qual -> 3.33.0
     \--- com.google.errorprone:error_prone_annotations -> 2.18.0

That dependency is only excluded once:

% ./gradlew dependencies --configuration=runtimeClasspath

> Task :dependencies

------------------------------------------------------------
Root project 'test-guava-restrict'
------------------------------------------------------------

runtimeClasspath - Runtime classpath of source set 'main'.
\--- io.dropwizard:dropwizard-jackson:4.0.2
     +--- com.google.guava:guava:32.1.2-jre
     |    +--- com.google.guava:guava-parent:32.1.2-jre
     |    |    +--- org.checkerframework:checker-qual:3.33.0 -> 3.38.0 (c)
     |    |    \--- com.google.errorprone:error_prone_annotations:2.18.0 -> 2.21.1 (c)
     |    +--- com.google.guava:failureaccess:1.0.1
     |    +--- com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
     |    +--- com.google.code.findbugs:jsr305 FAILED
     |    +--- org.checkerframework:checker-qual -> 3.38.0
     |    \--- com.google.errorprone:error_prone_annotations -> 2.21.1
     +--- com.github.ben-manes.caffeine:caffeine:3.1.8
     |    +--- org.checkerframework:checker-qual:3.37.0 -> 3.38.0
     |    \--- com.google.errorprone:error_prone_annotations:2.21.1

Expected Behavior

I believe Gradle should exclude the dependency wherever it exists under that tree, not just the first time it happens. The output should be:

% ./gradlew dependencies --configuration=runtimeClasspath

> Task :dependencies

------------------------------------------------------------
Root project 'test-guava-restrict'
------------------------------------------------------------

runtimeClasspath - Runtime classpath of source set 'main'.
\--- io.dropwizard:dropwizard-jackson:4.0.2
     +--- com.google.guava:guava:32.1.2-jre
     |    +--- com.google.guava:guava-parent:32.1.2-jre
     |    |    +--- org.checkerframework:checker-qual:3.33.0 -> 3.38.0 (c)
     |    |    \--- com.google.errorprone:error_prone_annotations:2.18.0 -> 2.21.1 (c)
     |    +--- com.google.guava:failureaccess:1.0.1
     |    +--- com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
     |    +--- org.checkerframework:checker-qual -> 3.38.0
     |    \--- com.google.errorprone:error_prone_annotations -> 2.21.1
     +--- com.github.ben-manes.caffeine:caffeine:3.1.8
     |    +--- org.checkerframework:checker-qual:3.37.0 -> 3.38.0
     |    \--- com.google.errorprone:error_prone_annotations:2.21.1

I know it seems like it should be a Dropwizard or Guava issue, but I'm here because it works on maven:

  <dependencies>
    <dependency>
      <groupId>io.dropwizard</groupId>
      <artifactId>dropwizard-jackson</artifactId>
      <version>4.0.2</version>
    </dependency>
  </dependencies>

% mvn dependency:tree
[INFO] com.mycompany.app:my-app:jar:1.0-SNAPSHOT
[INFO] \- io.dropwizard:dropwizard-jackson:jar:4.0.2:compile
[INFO]    +- com.google.guava:guava:jar:32.1.2-jre:compile
[INFO]    |  +- com.google.guava:failureaccess:jar:1.0.1:compile
[INFO]    |  +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO]    |  +- com.google.errorprone:error_prone_annotations:jar:2.18.0:compile
[INFO]    |  \- com.google.j2objc:j2objc-annotations:jar:2.8:compile
[INFO]    +- com.github.ben-manes.caffeine:caffeine:jar:3.1.8:compile
[INFO]    +- io.dropwizard:dropwizard-util:jar:4.0.2:compile
[INFO]    +- com.fasterxml.jackson.core:jackson-core:jar:2.15.2:compile
[INFO]    +- com.fasterxml.jackson.core:jackson-annotations:jar:2.15.2:compile
[INFO]    +- com.fasterxml.jackson.core:jackson-databind:jar:2.15.2:compile
[INFO]    +- com.fasterxml.jackson.datatype:jackson-datatype-guava:jar:2.15.2:compile
[INFO]    +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.15.2:compile
[INFO]    +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.15.2:compile
[INFO]    +- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.15.2:compile
[INFO]    +- com.fasterxml.jackson.module:jackson-module-blackbird:jar:2.15.2:compile
[INFO]    +- org.slf4j:slf4j-api:jar:2.0.9:compile
[INFO]    \- org.checkerframework:checker-qual:jar:3.38.0:compile

Context (optional)

I have to explicitly include Guava (or explicitly exclude it) in order to avoid ending up in this unbuildable state.

Steps to Reproduce

Unzip test-guava-restrict.zip and run ./gradlew cJ.

Gradle version

8.3

Build scan URL (optional)

No response

Your Environment (optional)

No response

[jeffalder]

This was introduced by a change in Guava, I believe. Guava 32.0.1 does not show the guava-parent dependency through Gradle, but Guava 32.1.0 does present it. Nonetheless, it seems like the change works in maven but not Gradle.

[ov7a]

Sorry that you're having trouble with Gradle!

This is the intended behavior, and there’s no plan to change it. This issue will be closed.

---

Maven and Gradle have different approaches to dependency resolution.

See these issues for more context:

• Gradle dependency issue in v3.0.2 with Guava and Findbugs dropwizard/dropwizard#7592
• Dropwizard-jetty/core pulls in javax.servlet transitively dropwizard/dropwizard#4290
• guava:32.1.1-jre causes issues with mockito-core:3.x google/guava#6654 and this reply in particular.

As you said, you can explicitly exclude the unwanted dependency in your build script as a workaround.

[jeffalder]

OK, so modifying the gradle dependencies this way allowed the build, but re-instated jsr305.

dependencies {
    implementation(platform("com.google.guava:guava-parent:32.1.2-jre"))
    implementation "io.dropwizard:dropwizard-jackson:4.0.2"
}

[jeffalder]

Copying the exclusion down a level also worked.

dependencies {
    implementation("io.dropwizard:dropwizard-jackson:4.0.2") {
        exclude group: "com.google.code.findbugs"
    }
}