This message was deleted.

I think the constraint is in the right place (it shows in the scan - 3 times actually...). But in order to downgrade, you need to make it strict:

classpath("org.yaml:snakeyaml:1.33!!")

// or (long notation)

classpath("org.yaml:snakeyaml") {
  version { strictly("1.33") }
}

thanks jendrik. It would be great to declare that somehow on the outgoing project wouldn't it?

Yes. I missed that in the scan. You can declare the strict constraint in ':build-tools-internal' and that should also work.

dependency.constraints {
  implementation("org.yaml:snakeyaml:1.33!!")
}