autonomousapps / autonomousapps/dependency-analysis-gradle-plugin
Guava checks ignore dependencies resolution that may bump guava to higher version
- Dominant language
- Kotlin
- Stars
- 2.2k
- Forks
- 158
- Avg merge
- 16h 25m
- Merged PRs (30d)
- 46
Description
**Plugin version**
2.4.2
**Gradle version**
8.11
**JDK version**
17
**(Optional) Kotlin and Kotlin Gradle Plugin (KGP) version**
2.0.21
**(Optional) Android Gradle Plugin (AGP) version**
8.7.2.
**Describe the bug**
I cannot even configure project with latest version which include guava version check.
Plugin says:
```
The Dependency Analysis Gradle Plugin requires Guava 33.1.0 or higher. Your build is using Guava 32.1.3-jre,
which is too low. Please update your dependencies.
Guava was loaded in the classloader named
ClassLoaderScopeIdentifier.Id{coreAndPlugins:settings[:](export)}
```
But when I print deps to understand from where I got wrong guava version - I saw this:
```
+--- androidx.build.gradle.gcpbuildcache:androidx.build.gradle.gcpbuildcache.gradle.plugin:1.0.0
| \--- androidx.build.gradle.gcpbuildcache:gcpbuildcache:1.0.0
| +--- com.squareup.okhttp3:okhttp-bom:4.12.0
| | \--- com.squareup.okhttp3:okhttp:4.12.0 (c)
| +--- com.google.cloud:google-cloud-storage:2.30.1
| | +--- com.google.guava:guava:32.1.3-jre -> 33.1.0-jre
| | +--- com.google.guava:failureaccess:1.0.1
| | +--- com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
```
**To Reproduce**
Idk minimal example, but my project looks similar to this
1. composite build with two modules:
1.1 . build-logic-settings -> :build-logic-settings:build-cache -> implementation("androidx.build.gradle.gcpbuildcache:androidx.build.gradle.gcpbuildcache.gradle.plugin:1.0.0")
1.2 build-logic -> :build-logic:plugins -> implementation("com.autonomousapps:dependency-analysis-gradle-plugin:2.4.2")
1.3 try to bump guava here to at least 33.1.0 like `implementation("com.google.guava:guava:33.1.0-jre")`
2. Try to sync
3. You should get the same error
I found the only way to fix - to add `implementation("com.google.guava:guava:33.1.0-jre")` before lib that require guava. But it's even another composite project, it seems irrational, but maybe I'm wrong
**Expected behavior**
DAGP do not fails fast
Contributor guide
Research direction
Reproduce the composite build described in the issue, including build-logic-settings, build-cache, and build-logic:plugins, then inspect how Guava dependencies are resolved before the plugin's version check. Done means the check accounts for the resolved higher Guava version and does not fail fast when the dependency graph upgrades Guava to at least 33.1.0.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, kotlin
- Domain
- build-system, devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100