This message was deleted.

afaik enforcedPlatform means it's enforced and can't be overridden without using an excludes: "Using

enforcedPlatform

needs to be considered with care if your software component can be consumed by others. This declaration is effectively transitive and so will apply to the dependency graph of your consumers. Unfortunately they will have to use

exclude

if they happen to disagree with one of the forced versions. Instead, if your reusable software component has a strong opinion on some third party dependency versions, consider using a rich version declaration with a

strictly

." From https://docs.gradle.org/current/userguide/platforms.html#sub:bom_import

That's what I also thought after reading the above but I see that in the described case Gradle resolves the higher version instead of the versions that the bom brings. This is our case:

X --> implementation platform ('A:+')
X --> implementation platform (D:new_version)
A --> api platform(project(':B'))
B --> api platform(project(':C'))
C --> api enforcedPlatform("D:$old_version")

In the case above X receives D with a higher version. I thought that any enforcedPlatform in the graph will be enforced over other platforms.