autonomousapps / autonomousapps/dependency-analysis-gradle-plugin

False positive: Advises removing spring-core altough RetryContext.setAttribute is used

Open
#1,592 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Kotlin
Stars
2.2k
Forks
158
Avg merge
16h 25m
Merged PRs (30d)
46

Description

**Build scan link**

**Plugin version**
3.4.1

**Gradle version**
9.2.0

**JDK version**
21

**(Optional) Kotlin and Kotlin Gradle Plugin (KGP) version**

**(Optional) Android Gradle Plugin (AGP) version**

**(Optional) `reason` output for bugs relating to incorrect advice**

```
> Task :subproject:reason

------------------------------------------------------------
You asked about the dependency 'org.springframework:spring-core:6.0.23'.
You have been advised to change this dependency to 'runtimeOnly' from 'implementation'.
------------------------------------------------------------

Shortest path from :subproject to org.springframework:spring-core:6.0.23 for compileClasspath:
:subproject
\--- org.springframework:spring-core:6.0.23

Shortest path from :subproject to org.springframework:spring-core:6.0.23 for runtimeClasspath:
:subproject
\--- org.springframework:spring-core:6.0.23

Shortest path from :subproject to org.springframework:spring-core:6.0.23 for testCompileClasspath:
:subproject
\--- org.springframework:spring-core:6.0.23

Shortest path from :subproject to org.springframework:spring-core:6.0.23 for testRuntimeClasspath:
:subproject
\--- org.springframework:spring-core:6.0.23

Source: main
------------
* Provides 2 service loaders: , org.springframework.core.ReactiveAdapterRegistry$SpringCoreBlockHoundIntegration (implies runtimeOnly).

Source: test
------------
* Provides 2 service loaders: , org.springframework.core.ReactiveAdapterRegistry$SpringCoreBlockHoundIntegration (implies testRuntimeOnly).
```

**Describe the bug**
I think I should open an issue with spring-retry that they fail to declare spring-core as a api dependency, but anyhow:

The plugin advises removing spring-core or changing it to runtimeOnly when my code calls the setAttribute method on a org.springframework.retry.RetryContext object.

The RetryContext interface (from spring-retry) extends the org.springframework.util.AttributeAccessor interface (from spring-core). The setAttribute method is defined on this parent interface. Therefore, spring-core is a required compile-time dependency to resolve that method call.

Following the plugin's advice results in a compilation error: Unresolved reference: setAttribute.

**To Reproduce**
Steps to reproduce the behavior:
run buildHealth in the [repro project](https://github.com/patrick-dedication/dagp-transitive-interface-usage)

**Expected behavior**
The plugin should recognize that spring-core is a necessary compile-time dependency because a method from one of its interfaces (AttributeAccessor.setAttribute) is being used via a subclass (RetryContext). It should not advise for the removal or modification of the spring-core dependency.

**Additional context**

Contributor guide

Open the contributing guide

Research direction

Start by running buildHealth in the linked dagp-transitive-interface-usage repro project and inspect how dependency usage through inherited interfaces is analyzed. Trace the advice that marks spring-core as runtimeOnly when RetryContext.setAttribute is called. Done means the analyzer recognizes AttributeAccessor.setAttribute usage and no longer advises removing or changing spring-core.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, kotlin
Domain
build-system, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.