https://gradle.com/ logo
Join Slack
Powered by
Strange thing started happening today to my projec...
# community-support
i
Strange thing started happening today to my project build. The project build started failing today, because it is selecting very old version of the dependency `commons-iocommons io20030203.000550`` instead of a newer one. Does anybody have an idea what could have caused it? I will put "dependencyInsight" in the thread.
Copy code
$ ./gradlew :conductor-app:dependencyInsight --dependency commons-io --configuration testRuntimeClasspath
Calculating task graph as no cached configuration is available for tasks: :conductor-app:dependencyInsight --dependency commons-io --configuration testRuntimeClasspath

> Task :conductor-app:dependencyInsight
commons-io:commons-io:20030203.000550
  Variant runtime:
    | Attribute Name                 | Provided     | Requested    |
    |--------------------------------|--------------|--------------|
    | org.gradle.status              | release      |              |
    | org.gradle.category            | library      | library      |
    | org.gradle.libraryelements     | jar          | jar          |
    | org.gradle.usage               | java-runtime | java-runtime |
    | org.gradle.dependency.bundling |              | external     |
    | org.gradle.jvm.environment     |              | standard-jvm |
    | org.gradle.jvm.version         |              | 25           |
   Selection reasons:
      - Selected by rule: Restricting commons-io:commons-io to version [2.14.0,)

commons-io:commons-io:2.11.0 -> 20030203.000550
\--- org.apache.zookeeper:zookeeper:3.8.4
     +--- org.springframework.kafka:spring-kafka-test:3.3.10
     |    \--- testRuntimeClasspath (requested org.springframework.kafka:spring-kafka-test)
     \--- org.apache.kafka:kafka_2.13:3.9.1
          \--- org.springframework.kafka:spring-kafka-test:3.3.10 (requested org.apache.kafka:kafka_2.13:3.8.1) (*)

commons-io:commons-io:2.14.0 -> 20030203.000550
\--- org.apache.kafka:kafka_2.13:3.9.1
     \--- org.springframework.kafka:spring-kafka-test:3.3.10 (requested org.apache.kafka:kafka_2.13:3.8.1)
          \--- testRuntimeClasspath (requested org.springframework.kafka:spring-kafka-test)

commons-io:commons-io:2.20.0 -> 20030203.000550
\--- org.apache.commons:commons-compress:1.28.0
     \--- org.testcontainers:testcontainers:1.21.3 (requested org.apache.commons:commons-compress:1.24.0)
          +--- org.testcontainers:kafka:1.21.3
          |    \--- testRuntimeClasspath (requested org.testcontainers:kafka)
          +--- org.testcontainers:mongodb:1.21.3
          |    \--- testRuntimeClasspath (requested org.testcontainers:mongodb)
          \--- org.testcontainers:rabbitmq:1.21.3
               \--- testRuntimeClasspath (requested org.testcontainers:rabbitmq)
I see here that Gradle follows the selection rule 
[2.14.0,)
and using this rule select 
20030203.000550
. Funny part is, that is was working all the time until today. No Gradle configuration in the project was changed in the recent time. Can it be some kind of a Gradle bug/regression? How can I globally cancel the "`20030203.000550`" version of this library? Thanks.
n
i
tried:
Copy code
dependencies {
    constraints {
        testImplementation("commons-io:commons-io") {
            version {
                reject("20030203.000550")
            }
        }
    }
}
the project still selects the wrong version:
Copy code
$ ./gradlew :conductor-app:dependencyInsight --dependency commons-io --configuration testRuntimeClasspath

> Task :conductor-app:dependencyInsight
commons-io:commons-io:20030203.000550
...
   Selection reasons:
      - Selected by rule: Restricting commons-io:commons-io to version [2.14.0,)
      - By constraint

commons-io:commons-io:{prefer 2.21.0; reject 20030203.000550} -> 20030203.000550
\--- testRuntimeClasspath

commons-io:commons-io:2.11.0 -> 20030203.000550
\--- org.apache.zookeeper:zookeeper:3.8.4
     +--- org.springframework.kafka:spring-kafka-test:3.3.10
     |    \--- testRuntimeClasspath (requested org.springframework.kafka:spring-kafka-test)
     \--- org.apache.kafka:kafka_2.13:3.9.1
          \--- org.springframework.kafka:spring-kafka-test:3.3.10 (requested org.apache.kafka:kafka_2.13:3.8.1) (*)

commons-io:commons-io:2.14.0 -> 20030203.000550
\--- org.apache.kafka:kafka_2.13:3.9.1
     \--- org.springframework.kafka:spring-kafka-test:3.3.10 (requested org.apache.kafka:kafka_2.13:3.8.1)
          \--- testRuntimeClasspath (requested org.springframework.kafka:spring-kafka-test)

commons-io:commons-io:2.20.0 -> 20030203.000550
\--- org.apache.commons:commons-compress:1.28.0
     \--- org.testcontainers:testcontainers:1.21.3 (requested org.apache.commons:commons-compress:1.24.0)
          +--- org.testcontainers:kafka:1.21.3
          |    \--- testRuntimeClasspath (requested org.testcontainers:kafka)
          +--- org.testcontainers:mongodb:1.21.3
          |    \--- testRuntimeClasspath (requested org.testcontainers:mongodb)
          \--- org.testcontainers:rabbitmq:1.21.3
               \--- testRuntimeClasspath (requested org.testcontainers:rabbitmq)
Tried to add "strictly" - same result
t
Where does your 
[2.14.0,)
rule come from? Maybe change it to 
[2.14.0,20030203.000550)
or similar then?
v
On 2025-11-04 the version 
2.21.0
of 
commons-io
was released. https://repo1.maven.org/maven2/commons-io/commons-io/maven-metadata.xml lists 
20030203.000550
as a version. I guess before that release it was not listed as version there and thus not selected.
i
Sounds reasonable! That may explain why my build started failing without us changing anything.
v
Besides that using ranges is never a good idea, especially without dependency locking, maybe you should open a bug with 
commons-io
. I don't find one related to this, though I mean to remember that I've seen this problem in the past already.
Also, do you happen to use the Spring Dependency Management plugin?
Because if I put
Copy code
dependencies {
    testImplementation("commons-io:commons-io:[2.14.0,)")
    constraints {
        testImplementation("commons-io:commons-io") {
            version {
                reject("20030203.000550")
            }
        }
    }
}
it works as expected, resolving to 2.21.0. And the SDM plugin is one of the typical causes for strange behavior in dependency resolution without visual sign in Build Scan or 
dependencyInsight
output.
i
I just found the line:
Copy code
restrictVersionOf("commons-io", "commons-io", "[2.14.0,)")
in our project. It was added to block out some old vulnerable versions. Just removed it and it started to pick the proper version "2.20.0"
For context:
Copy code
allprojects {
    configurations.all {
        resolutionStrategy {
            eachDependency {
                // restrict versions of some dependencies due to known vulnerabilities
                restrictVersionOf("commons-io", "commons-io", "[2.14.0,)")
                restrictVersionOf("org.apache.commons", "commons-compress", "[1.26.0,)")
            }
        }
    }
}
(Yes, we use Spring Dep Mgmt)
v
Ugh, baaad snippet. Besides that 
restrictVersionOf
is also something custom
Yes, we use Spring Dep Mgmt
It is a relict from times when Gradle did not have built-in BOM support. By now it does more harm than good, and even the author of the plugin recommends not to use it anymore, but the built-in BOM support using 
platform(...)
.
i
Just found `restrictVersionOf`:
Copy code
fun DependencyResolveDetails.restrictVersionOf(group: String, name: String, version: String) {
    if (requested.group == group && requested.name == name) {
        useVersion(version)
        because("Restricting $group:$name to version $version")
    }
}
so, it is just 
useVersion
Thanks you all and especially Vampire!
👌 1
Open in Slack
PreviousNext
Powered by