autonomousapps / autonomousapps/dependency-analysis-gradle-plugin

Used transitive dependency not reported if declared as runtimeOnly

Open
#1,864 4 comments 0 reactions 0 assignees View on GitHub
bug more information needed
Dominant language
Kotlin
Stars
2.2k
Forks
158
Avg merge
16h 25m
Merged PRs (30d)
46

Description

### Contributor Checklist
- [x] I have read the [Contributing guide](https://github.com/autonomousapps/dependency-analysis-gradle-plugin/blob/main/CONTRIBUTING.asciidoc).
- [x] I have read the [Code of Conduct](https://github.com/autonomousapps/dependency-analysis-gradle-plugin/blob/main/CODE_OF_CONDUCT.md).
- [x] No part of this bug report was created with an LLM/AI.

### Reproducer
see attached ZIP file: [dependency-analysis.zip](https://github.com/user-attachments/files/31738187/dependency-analysis.zip)

### Plugin version
3.19.1

### Gradle version
8.14.1

### JDK version
JDK 25

### `reason` output for bugs relating to incorrect advice

```
------------------------------------------------------------
You asked about the dependency 'org.mockito:mockito-core:5.8.0'.
There is no advice regarding this dependency.
------------------------------------------------------------

There is no path from :app2 to org.mockito:mockito-core:5.8.0 for compileClasspath

There is no path from :app2 to org.mockito:mockito-core:5.8.0 for runtimeClasspath

Shortest path from :app2 to org.mockito:mockito-core:5.8.0 for testCompileClasspath:
:app2
\--- :test-api
\--- org.mockito:mockito-core:5.8.0

Shortest path from :app2 to org.mockito:mockito-core:5.8.0 for testRuntimeClasspath:
:app2
\--- org.mockito:mockito-core:5.8.0

Source: main
------------
(no usages)

Source: test
------------
* Uses 1 class: org.mockito.Mockito (implies testImplementation).

```

### Describe the bug
Consider the following setup (see [reproducer](https://github.com/user-attachments/files/31738187/dependency-analysis.zip)):

* Project "test-api" exposes `org.mockito:mockito-core` as `api`
* Project "app2" depends on `test-api` AND directly uses `org.mockito:mockito-core`
* Project "app2" declares `org.mockito:mockito-core` as `testRuntimeOnly` (which is incorrect)

Now when I run "projectHealth" no problems are reported. But compilation of "app2" relies on the transitive dependency on Mockito from "test-api". So once "test-api" decides to remove this dependency compilation of "app2" will fail.
I would expect the plugin to report the misconfiguration of Mockito as `testRuntimeOnly` and propose `testImplementation` instead. The plugin does seem to know which configuration would be correct, see output of the "reason" task above.

### To Reproduce
Run "projectHealth" in [reproducer](https://github.com/user-attachments/files/31738187/dependency-analysis.zip)

### Expected behavior
As pointed out by the output of the reason task the dependency should be flagged as "testImplementation" not "testRuntimeOnly".
When I remove the "testRuntimeOnly" dependency the used transitive dependency is reported correctly

[dependency-analysis.zip](https://github.com/user-attachments/files/31738187/dependency-analysis.zip)

Contributor guide

Open the contributing guide

Research direction

Run projectHealth with the attached dependency-analysis.zip, then compare its result with the provided reason task output for app2 and Mockito. Trace how testRuntimeOnly is handled when the dependency is also supplied transitively, and confirm that projectHealth reports testImplementation as the required configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, kotlin
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.