jdaugherty opened a new pull request, #16644:
URL: https://github.com/apache/grails-core/pull/16644
ehcache requires `jaxb-runtime` as the version range `[3,3.1)`, the only
dynamic version in the dependency graph of a Grails application. A range makes
every resolution list the module's versions on Maven Central once the listing
cache expires, which is every CI build because the root build sets
`cacheDynamicVersionsFor` to zero there. That listing is the one request a warm
build still sends to Central at configuration time, and when it fails Gradle
disables the repository for the rest of the build. The "Functional Tests (Java
25, indy=false)" job of #16599 died that way while the CLI companion probe
resolved `grailsCliDetect`, before any test ran:
```
Could not resolve all dependencies for configuration
':grails-test-examples-plugins-loadafter:grailsCliDetect'.
> Could not resolve org.glassfish.jaxb:jaxb-runtime:[3,3.1).
> Repository MavenRepo is disabled due to earlier error below:
```
### Changes
- Exclude `jaxb-runtime` from the ehcache dependency in
`grails-spring-security` and `grails-spring-security-acl` and declare the
BOM-managed coordinate in its place. The resolved classpath is unchanged (4.0.9
by constraint); only the version listing goes away.
- `validateDependencyVersions` now rejects any dependency of a BOM-bearing
configuration that requests a dynamic version (a range, a `+` prefix, or
`latest.*`), reported as `from -> group:name:version`. Gradle's
`failOnDynamicVersions()` does not catch a range a BOM constraint overrides,
which is exactly this shape, so the validator inspects the requested selectors
of the resolved graph instead. The sweep over every module passes with the
exclusion in place and fails without it.
- TestKit features for the new rule (a transitive range fails; the exclusion
plus the BOM-managed coordinate passes) and a unit test for the version
classifier.
- The rule is documented in `AGENTS.md` and the gradle-developer skill.
### Verification
- `build-logic` validator specs pass (27 tests).
- `./gradlew validateDependencyVersions` passes across every module.
- `:grails-test-examples-plugins-loadafter:dependencyInsight` on
`grailsCliDetect` shows `jaxb-runtime` 4.0.9 by constraint with no range edge.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
