CODEWITHSUNDEEP
gradledependency-managementgradle-dependencies
Ondra Žižka
Ondra Žižka

Reputation: 46876

What's the logic of Gradle dependency resolving

In Gradle 6.7, we have a dependencyManagement.dependencies to set the defaults for the project.

Recently, someone replaced the individual dependency lines for Spring with a dependencySet.

dependencySet(group: 'org.springframework.boot', version: "2.2.11.RELEASE") {
            entry 'spring-boot-devtools'
            entry 'spring-boot-dependencies'
            entry 'spring-boot-devtools'
            entry 'spring-boot-starter-aop'
            entry 'spring-boot-starter-cache'
            entry 'spring-boot-starter-webflux'
            ...

Now after spotting some CVE alerts, I found out that Gradle resolves spring-boot-starter-cache to 2.2.8 anyway. I am not sure where it's getting that version from: We don't have it in our project, and the deps tree appears as if we asked for it ourselves (it's at level 0).

+--- org.springframework.boot:spring-boot-starter-cache -> 2.2.8.RELEASE

When I add the item explicitly, as we had before for all,

dependency 'org.springframework.boot:spring-boot-starter-cache:2.2.11.RELEASE'

then it ends up being resolved as 2.2.11.

+--- org.springframework.boot:spring-boot-starter-cache -> 2.2.11.RELEASE

In Maven, dependency management is very straighforward, compared to this: You control it using dependency management, and BOMs, and all works, no surprises like this.

So maybe I am missing something in Gradle's logic, even after reading the dependency management guide.

How can I use BOM-like dependencySet to control all entry-es at once? Or do I have wrong assumptions?

Upvotes: 1

Views: 193

Answers (1)

Cisco
Cisco

Reputation: 23042

In Gradle 6.7, we have a dependencyManagement.dependencies to set the defaults for the project.

Do not confuse Spring's dependency management Gradle plugin with Gradle's native dependency mangaement functionality. Although they achieve the same goal, they do it in very different ways.

I am not sure where it's getting that version from: We don't have it in our project, and the deps tree appears as if we asked for it ourselves (it's at level 0).

You can use the dependencyInsight task to get more information on a specific dependency and why a specific version was chosen.

./gradlew dependencyInsight --dependency org.springframework.boot:spring-boot-starter-cache

See Viewing and debugging dependencies for more details.

How can I use BOM-like dependencySet to control all entry-es at once? Or do I have wrong assumptions?

The docs for the Spring dependency management plugin are clear what you need to do to achieve that: https://docs.spring.io/dependency-management-plugin/docs/current/reference/html/#dependency-management-configuration-dsl-dependency-sets

If it is not working as you expect, then you need to debug your dependencies as I have linked above.

Also from your examples, my guess is that you have a typical Spring Boot application with the Spring Boot Gradle plugin applied. If so, then the Spring Boot Gradle plugin detects if the Spring dependency management plugin is applied and automatically imports the Spring Boot BOM. So there should not be a need to manage Spring specific dependencies as you are.

Upvotes: 1

Related Questions