I have an issue with a transitive dependency which is select Gradle Community #community-support

I have an issue with a transitive dependency which...

Axel Bock

09/08/2025, 10:30 AM

I have an issue with a transitive dependency which is selected by a rule. I don't quite understand why the older dependency is picked.

Copy code

io.netty:netty-codec-http:4.1.124.Final	
\--- io.netty:netty-codec-http2:4.1.124.Final	
     \--- software.amazon.awssdk:netty-nio-client:2.33.4 (requested io.netty:netty-codec-http2:4.1.126.Final)	
          \--- software.amazon.awssdk:s3:2.33.4	
               \--- runtimeClasspath

So I am getting the latest awssdk:s3, which asks for netty 4.1.126.Final. However gradle chooses to pick jetty 4.1.124.Final instead. I don't have any other dependencies to jetty in the project (transitive or direct). This is the info by dependencyInsight:

Copy code

io.netty:netty-codec-http:4.1.124.Final (selected by rule)	
  Variant runtime:	
    | Attribute Name                 | Provided     | Requested    |	
    |--------------------------------|--------------|--------------|	
    | org.gradle.status              | release      |              |	
    | org.gradle.category            | library      | library      |	
    | org.gradle.libraryelements     | jar          | jar          |	
    | org.gradle.usage               | java-runtime | java-runtime |	
    | org.gradle.dependency.bundling |              | external     |	
    | org.gradle.jvm.environment     |              | standard-jvm |	
    | org.gradle.jvm.version         |              | 21           |

Can someone explain?

Vampire

09/08/2025, 11:18 AM

Can you share a build

--scan

URL?

Axel Bock

09/08/2025, 11:54 AM

https://scans.gradle.com/s/jdhhxxxng6iyu

Vampire

09/08/2025, 12:08 PM

You should stop using the Spring dependency management plugin which most probably is the "culprit". It is a relict from times when Gradle did not have built-in BOM support, by now does more harm than good, and even its maintainer recommends not to use it anymore, but instead the built-in BOM support using

platform(...)

Axel Bock

09/08/2025, 12:12 PM

Thank you for the suggestion. I'll try that.

👌 1

Axel Bock

09/09/2025, 6:27 AM

so it actually worked, thank you so much @Vampire just want to confirm, this is how I declare spring boot dependencies now:

Copy code

plugins {
    id 'java'
    id 'org.springframework.boot' version '3.5.5'
}

dependencies {
    implementation platform(SpringBootPlugin.BOM_COORDINATES)
    implementation 'org.springframework.boot:spring-boot-starter-web'
}

But from my understanding, all the official spring boot docs are with io.spring.dependency-management. Isn't that odd? Also, for reference, do you have a link or so of the maintainer recommending not to use it anymore? Thanks again 🙏

Vampire

09/09/2025, 7:00 AM

just want to confirm, this is how I declare spring boot dependencies now:

👌 The only recommendation I have, is to switch to Kotlin DSL. By now it is the default DSL, you immediately get type-safe build scripts, actually helpful error messages if you mess up the syntax, and amazingly better IDE support if you use a good IDE like IntelliJ IDEA or Android Studio. :-)

But from my understanding, all the official spring boot docs are with io.spring.dependency-management.

They show both variants.

Isn't that odd?

That they show that one as first (if that is still the case) and their project generator uses it (if that is still the case), yes, I agree. Imho they should change that. 🤷‍♂️

Also, for reference, do you have a link or so of the maintainer recommending not to use it anymore?

Sure: https://linen.dev/s/gradle-community/t/2579116/what-is-the-proper-way-to-apply-a-bom-in-a-library-project-i#a7d4a60a-ab60-48dc-8477-f3f4462d1e6a

🙌 1

2 Views

Open in Slack

Previous Next