autonomousapps / autonomousapps/dependency-analysis-gradle-plugin

Guava checks ignore dependencies resolution that may bump guava to higher version

Open
#1,307 7 comments 0 reactions 0 assignees View on GitHub
bug more information needed
Dominant language
Kotlin
Stars
2.2k
Forks
158
Avg merge
16h 25m
Merged PRs (30d)
46

Description

**Plugin version**
2.4.2

**Gradle version**
8.11

**JDK version**
17

**(Optional) Kotlin and Kotlin Gradle Plugin (KGP) version**
2.0.21

**(Optional) Android Gradle Plugin (AGP) version**
8.7.2.

**Describe the bug**
I cannot even configure project with latest version which include guava version check.
Plugin says:

```
The Dependency Analysis Gradle Plugin requires Guava 33.1.0 or higher. Your build is using Guava 32.1.3-jre,
which is too low. Please update your dependencies.

Guava was loaded in the classloader named

ClassLoaderScopeIdentifier.Id{coreAndPlugins:settings[:](export)}
```

But when I print deps to understand from where I got wrong guava version - I saw this:

```
+--- androidx.build.gradle.gcpbuildcache:androidx.build.gradle.gcpbuildcache.gradle.plugin:1.0.0
| \--- androidx.build.gradle.gcpbuildcache:gcpbuildcache:1.0.0
| +--- com.squareup.okhttp3:okhttp-bom:4.12.0
| | \--- com.squareup.okhttp3:okhttp:4.12.0 (c)
| +--- com.google.cloud:google-cloud-storage:2.30.1
| | +--- com.google.guava:guava:32.1.3-jre -> 33.1.0-jre
| | +--- com.google.guava:failureaccess:1.0.1
| | +--- com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
```

**To Reproduce**
Idk minimal example, but my project looks similar to this
1. composite build with two modules:
1.1 . build-logic-settings -> :build-logic-settings:build-cache -> implementation("androidx.build.gradle.gcpbuildcache:androidx.build.gradle.gcpbuildcache.gradle.plugin:1.0.0")
1.2 build-logic -> :build-logic:plugins -> implementation("com.autonomousapps:dependency-analysis-gradle-plugin:2.4.2")
1.3 try to bump guava here to at least 33.1.0 like `implementation("com.google.guava:guava:33.1.0-jre")`
2. Try to sync
3. You should get the same error

I found the only way to fix - to add `implementation("com.google.guava:guava:33.1.0-jre")` before lib that require guava. But it's even another composite project, it seems irrational, but maybe I'm wrong

**Expected behavior**
DAGP do not fails fast

Contributor guide

Open the contributing guide

Research direction

Reproduce the composite build described in the issue, including build-logic-settings, build-cache, and build-logic:plugins, then inspect how Guava dependencies are resolved before the plugin's version check. Done means the check accounts for the resolved higher Guava version and does not fail fast when the dependency graph upgrades Guava to at least 33.1.0.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, kotlin
Domain
build-system, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.