autonomousapps / autonomousapps/dependency-analysis-gradle-plugin
Narrow down transitive dependencies advice
- Dominant language
- Kotlin
- Stars
- 2.2k
- Forks
- 158
- Avg merge
- 16h 25m
- Merged PRs (30d)
- 46
Description
**Is your feature request related to a problem? Please describe.**
As I library owner, I would like to narrow down used transitive dependencies to fail only if there are ones required to be declared as 'api'.
```
onUsedTransitiveDependencies {
severity('fail')
}
```
Example output which should fail:
```
These transitive dependencies should be declared directly:
api 'com.fasterxml.jackson.core:jackson-annotations:2.18.4'
api 'com.fasterxml.jackson.core:jackson-core:2.18.4'
api 'com.fasterxml.jackson.core:jackson-databind:2.18.4'
api 'jakarta.validation:jakarta.validation-api:3.0.2'
implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.18.4'
implementation 'com.fasterxml.jackson.module:jackson-module-parameter-names:2.18.4'
```
Example which should not fail should not fail this check even though severity is fail:
```
These transitive dependencies should be declared directly:
implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.18.4'
implementation 'com.fasterxml.jackson.module:jackson-module-parameter-names:2.18.4'
```
It may be a symptom of different issue, I'm trying to address.
If I expose library with ABI which contains Message class from spring-messaging, and have next dependency configuration:
```
dependencyAnalysis {
issues {
onIncorrectConfiguration {
severity('fail')
}
onUsedTransitiveDependencies {
severity('ignore')
}
}
}
dependencies {
implementation 'org.springframework:spring-jms'
}
```
Should the incorrect configuration check fail, and propose to rise spring-jms to api, which will trigger my attention? bcz spring-messaging is exposed and it's transitive dependency:
```
Shortest path from root project to org.springframework:spring-messaging:6.2.7 for compileClasspath:
:
\--- org.springframework:spring-jms:6.2.7
\--- org.springframework:spring-messaging:6.2.7
```
**Describe the solution you'd like**
Not sure how bad is idea to expose filter over advices. to end users.
Otherwise in case of transitive dependency represented in ABI but not declared directly, closest parent dependency should be proposed to be upgraded due to incorrect configuration.
**Describe alternatives you've considered**
Don't have any.
Contributor guide
Research direction
Start by tracing the onUsedTransitiveDependencies and onIncorrectConfiguration advice paths and compare them with the provided dependency examples. Done should mean severity fail only flags transitive dependencies required in the public API, while an exposed transitive dependency suggests promoting its closest parent dependency to api.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100