autonomousapps / autonomousapps/dependency-analysis-gradle-plugin

Narrow down transitive dependencies advice

Open
#1,589 5 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Kotlin
Stars
2.2k
Forks
158
Avg merge
16h 25m
Merged PRs (30d)
46

Description

**Is your feature request related to a problem? Please describe.**
As I library owner, I would like to narrow down used transitive dependencies to fail only if there are ones required to be declared as 'api'.
```
onUsedTransitiveDependencies {
severity('fail')
}
```
Example output which should fail:
```
These transitive dependencies should be declared directly:
api 'com.fasterxml.jackson.core:jackson-annotations:2.18.4'
api 'com.fasterxml.jackson.core:jackson-core:2.18.4'
api 'com.fasterxml.jackson.core:jackson-databind:2.18.4'
api 'jakarta.validation:jakarta.validation-api:3.0.2'
implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.18.4'
implementation 'com.fasterxml.jackson.module:jackson-module-parameter-names:2.18.4'
```
Example which should not fail should not fail this check even though severity is fail:
```
These transitive dependencies should be declared directly:
implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.18.4'
implementation 'com.fasterxml.jackson.module:jackson-module-parameter-names:2.18.4'
```

It may be a symptom of different issue, I'm trying to address.

If I expose library with ABI which contains Message class from spring-messaging, and have next dependency configuration:
```
dependencyAnalysis {
issues {
onIncorrectConfiguration {
severity('fail')
}
onUsedTransitiveDependencies {
severity('ignore')
}
}
}

dependencies {
implementation 'org.springframework:spring-jms'
}
```

Should the incorrect configuration check fail, and propose to rise spring-jms to api, which will trigger my attention? bcz spring-messaging is exposed and it's transitive dependency:
```
Shortest path from root project to org.springframework:spring-messaging:6.2.7 for compileClasspath:
:
\--- org.springframework:spring-jms:6.2.7
\--- org.springframework:spring-messaging:6.2.7
```

**Describe the solution you'd like**
Not sure how bad is idea to expose filter over advices. to end users.
Otherwise in case of transitive dependency represented in ABI but not declared directly, closest parent dependency should be proposed to be upgraded due to incorrect configuration.

**Describe alternatives you've considered**
Don't have any.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the onUsedTransitiveDependencies and onIncorrectConfiguration advice paths and compare them with the provided dependency examples. Done should mean severity fail only flags transitive dependencies required in the public API, while an exposed transitive dependency suggests promoting its closest parent dependency to api.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
build-system
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.