java - 如何配置 Gradle Java 平台以偏好更高的依赖版本？

Question

我的 spring boot gradle 多模块项目中出现以下错误。

Dependency resolution failed because of conflict(s) on the following module(s):
   - org.javassist:javassist between versions 3.24.0-GA and 3.20.0-GA

根本原因是 spring-boot-starter-data-jpa传递依赖于 3.24.0-GA 和 spring-boot-starter-thymeleaf传递地依赖于 3.20.0-GA。我正在使用 Gradle Java Platform Pulgin而不是 Spring Boot Gradle 插件。

问题:

如何配置 Gradle Java 平台以偏好更高的依赖版本？我想集中解决冲突，而不是在每个项目中解决。

Gradle 平台项目

plugins {
    `java-platform`
}

javaPlatform {
    allowDependencies()
}

dependencies {
    api(enforcedPlatform("org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE"))
    constraints {
        api(project(":core"))
        api(project(":email"))
        api(project(":security"))
        api(project(":app"))
        api("com.github.bbottema:emailaddress-rfc2822:2.1.4")
        api("com.icegreen:greenmail:1.5.11")
        api("nl.jqno.equalsverifier:equalsverifier:3.1.12")
        api("com.google.guava:guava:28.2-jre")
    }
}

安全模块 gradle 项目

plugins {
    `java-library-conventions`
}

dependencies {
    implementation(project(":core"))
    implementation(project(":email"))
    implementation("org.springframework.boot:spring-boot-starter-security")
    implementation("org.springframework.boot:spring-boot-starter-data-jpa")
    implementation("org.springframework.boot:spring-boot-starter-web")
    implementation("org.springframework.boot:spring-boot-starter-thymeleaf")

    testImplementation(testFixtures(project(":core")))
    testImplementation(testFixtures(project(":email")))
}

完整的依赖洞察报告

./gradlew :security:dependencyInsight --configuration compileClasspath --dependency org.javassist:javassist

> Task :security:dependencyInsight
Dependency resolution failed because of conflict(s) on the following module(s):
   - org.javassist:javassist between versions 3.24.0-GA and 3.20.0-GA

org.javassist:javassist:3.24.0-GA
   variant "compile" [
      org.gradle.status              = release (not requested)
      org.gradle.usage               = java-api
      org.gradle.libraryelements     = jar (compatible with: classes)
      org.gradle.category            = library

      Requested attributes not found in the selected variant:
         org.gradle.dependency.bundling = external
         org.gradle.jvm.version         = 11
   ]
   Selection reasons:
      - By conflict resolution : between versions 3.24.0-GA and 3.20.0-GA

org.javassist:javassist:3.24.0-GA
\--- org.hibernate:hibernate-core:5.4.12.Final
     +--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE
     |    \--- project :platform
     |         \--- compileClasspath
     \--- org.springframework.boot:spring-boot-starter-data-jpa:2.2.5.RELEASE
          +--- compileClasspath (requested org.springframework.boot:spring-boot-starter-data-jpa)
          \--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE (*)

org.javassist:javassist:3.20.0-GA -> 3.24.0-GA
\--- ognl:ognl:3.1.12
     \--- org.thymeleaf:thymeleaf:3.0.11.RELEASE
          +--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE
          |    \--- project :platform
          |         \--- compileClasspath
          +--- org.thymeleaf:thymeleaf-spring5:3.0.11.RELEASE
          |    +--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE (*)
          |    \--- org.springframework.boot:spring-boot-starter-thymeleaf:2.2.5.RELEASE
          |         +--- compileClasspath (requested org.springframework.boot:spring-boot-starter-thymeleaf)
          |         \--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE (*)
          \--- org.thymeleaf.extras:thymeleaf-extras-java8time:3.0.4.RELEASE
               +--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE (*)
               \--- org.springframework.boot:spring-boot-starter-thymeleaf:2.2.5.RELEASE (*)

(*) - dependencies omitted (listed previously)

A web-based, searchable dependency report is available by adding the --scan option.

BUILD SUCCESSFUL in 757ms
1 actionable task: 1 executed

Answer 1

不幸的是，这类问题无法通过 Gradle Java Platform 插件解决。该插件创建约束来帮助依赖解决过程获得所需的版本，但它不会消除冲突解决。您得到的错误是由于根本发生了冲突解决。在这种情况下，您会得到传递性的冲突依赖。唯一的解决方案是从带来不想要的版本的一阶依赖项中排除。
为了能够全局控制排除，您必须创建一个插件来执行此操作，然后每个项目都必须应用该插件。我们在 nebula-resolution-rules-plugin 中使用这种方法.不幸的是，我们的插件不支持您的用例，因此无法在此处重复使用。
我可能会建议停止使用 ResolutionStrategy:failOnVersionConflict .像 Spring 这样的库有许多依赖项，您可能会在其中解决冲突。您需要进行大量手动调整才能解决您的项目。