Keep dependencies that constrain resolution in RemoveRedundantDependencies - #195
Merged
Conversation
…encies`
A Gradle declaration such as
implementation('org.yaml:snakeyaml') {
version {
prefer '2.0'
strictly '[2.0,2.1)'
}
}
carries no version in its coordinate and exists to pin resolution, typically
above what an imported BOM manages. `isRedundant` compared only groupId,
artifactId, resolved version and declared exclusions, so it saw the artifact
supplied transitively at the very version the constraint had forced and deleted
the whole block, handing the version back to the rest of the graph.
Observed on Netflix/conductor, where the Spring Boot 2.7.3 BOM manages snakeyaml
1.30 and jackson-bom 2.13.3 and these blocks are what lift them to 2.0 and
2.15.x. Removal was also partial, dropping the jackson-core and
jackson-annotations pins while keeping the jackson-databind one, which cannot
resolve to a working Jackson classpath.
Skip any candidate whose requested version is a range or dynamic version. The
strict range surfaces in `getRequested().getVersion()`, so matching on version
syntax rather than on requested-differs-from-resolved keeps versionless
BOM-managed declarations removable and does not trip over Maven `${...}`
placeholders. Maven ranges use the same syntax, so both ecosystems are covered.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A Gradle declaration like
implementation('org.yaml:snakeyaml') { version { prefer '2.0'; strictly '[2.0,2.1)' } }carries no version in its coordinate and exists to pin resolution, typically above what an imported BOM manages, butisRedundantcompared only groupId, artifactId, resolved version and declared exclusions — so it saw the artifact supplied transitively at the very version the constraint had forced, and deleted the whole block.Observed on
Netflix/conductor, where the Spring Boot 2.7.3 BOM manages snakeyaml 1.30 and jackson-bom 2.13.3 and these blocks are what lift them to 2.0 and 2.15.x; the removal was also partial, dropping the jackson-core and jackson-annotations pins while keeping the jackson-databind one, which cannot resolve to a working Jackson classpath.This skips any candidate whose requested version is a range or dynamic version. The strict range surfaces in
getRequested().getVersion(), so matching on version syntax rather than on requested-differs-from-resolved keeps versionless BOM-managed declarations removable and does not trip over Maven${...}placeholders; Maven ranges use the same syntax, so both ecosystems are covered by the one guard inisRedundant.The added regression test reproduces the reported shape and fails without the guard.