autonomousapps / autonomousapps/dependency-analysis-gradle-plugin
False positive: Advises removing spring-core altough RetryContext.setAttribute is used
- Dominant language
- Kotlin
- Stars
- 2.2k
- Forks
- 158
- Avg merge
- 16h 25m
- Merged PRs (30d)
- 46
Description
**Build scan link**
**Plugin version**
3.4.1
**Gradle version**
9.2.0
**JDK version**
21
**(Optional) Kotlin and Kotlin Gradle Plugin (KGP) version**
**(Optional) Android Gradle Plugin (AGP) version**
**(Optional) `reason` output for bugs relating to incorrect advice**
```
> Task :subproject:reason
------------------------------------------------------------
You asked about the dependency 'org.springframework:spring-core:6.0.23'.
You have been advised to change this dependency to 'runtimeOnly' from 'implementation'.
------------------------------------------------------------
Shortest path from :subproject to org.springframework:spring-core:6.0.23 for compileClasspath:
:subproject
\--- org.springframework:spring-core:6.0.23
Shortest path from :subproject to org.springframework:spring-core:6.0.23 for runtimeClasspath:
:subproject
\--- org.springframework:spring-core:6.0.23
Shortest path from :subproject to org.springframework:spring-core:6.0.23 for testCompileClasspath:
:subproject
\--- org.springframework:spring-core:6.0.23
Shortest path from :subproject to org.springframework:spring-core:6.0.23 for testRuntimeClasspath:
:subproject
\--- org.springframework:spring-core:6.0.23
Source: main
------------
* Provides 2 service loaders: , org.springframework.core.ReactiveAdapterRegistry$SpringCoreBlockHoundIntegration (implies runtimeOnly).
Source: test
------------
* Provides 2 service loaders: , org.springframework.core.ReactiveAdapterRegistry$SpringCoreBlockHoundIntegration (implies testRuntimeOnly).
```
**Describe the bug**
I think I should open an issue with spring-retry that they fail to declare spring-core as a api dependency, but anyhow:
The plugin advises removing spring-core or changing it to runtimeOnly when my code calls the setAttribute method on a org.springframework.retry.RetryContext object.
The RetryContext interface (from spring-retry) extends the org.springframework.util.AttributeAccessor interface (from spring-core). The setAttribute method is defined on this parent interface. Therefore, spring-core is a required compile-time dependency to resolve that method call.
Following the plugin's advice results in a compilation error: Unresolved reference: setAttribute.
**To Reproduce**
Steps to reproduce the behavior:
run buildHealth in the [repro project](https://github.com/patrick-dedication/dagp-transitive-interface-usage)
**Expected behavior**
The plugin should recognize that spring-core is a necessary compile-time dependency because a method from one of its interfaces (AttributeAccessor.setAttribute) is being used via a subclass (RetryContext). It should not advise for the removal or modification of the spring-core dependency.
**Additional context**
Contributor guide
Research direction
Start by running buildHealth in the linked dagp-transitive-interface-usage repro project and inspect how dependency usage through inherited interfaces is analyzed. Trace the advice that marks spring-core as runtimeOnly when RetryContext.setAttribute is called. Done means the analyzer recognizes AttributeAccessor.setAttribute usage and no longer advises removing or changing spring-core.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, kotlin
- Domain
- build-system, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100