如何配置分级Java平台以更好地选择更高的依赖版本？

Question

在我的spring引导gradle多模块项目中，我得到了以下错误。

Dependency resolution failed because of conflict(s) on the following module(s):
   - org.javassist:javassist between versions 3.24.0-GA and 3.20.0-GA

其根本原因是spring-boot-starter-data-jpa传递依赖于3.24.0-GA，而spring-boot-starter-thymeleaf传递性依赖于3.20.0-GA.我使用的是分级Java平台Pulgin，而不是Spring插件。

问题：

• 如何配置Gradle Java平台以更好地选择更高的依赖版本？我想集中解决冲突-解决办法-而不是在每个项目中。

分级平台工程

plugins {
    `java-platform`
}

javaPlatform {
    allowDependencies()
}

dependencies {
    api(enforcedPlatform("org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE"))
    constraints {
        api(project(":core"))
        api(project(":email"))
        api(project(":security"))
        api(project(":app"))
        api("com.github.bbottema:emailaddress-rfc2822:2.1.4")
        api("com.icegreen:greenmail:1.5.11")
        api("nl.jqno.equalsverifier:equalsverifier:3.1.12")
        api("com.google.guava:guava:28.2-jre")
    }
}

安全模块分级项目

plugins {
    `java-library-conventions`
}

dependencies {
    implementation(project(":core"))
    implementation(project(":email"))
    implementation("org.springframework.boot:spring-boot-starter-security")
    implementation("org.springframework.boot:spring-boot-starter-data-jpa")
    implementation("org.springframework.boot:spring-boot-starter-web")
    implementation("org.springframework.boot:spring-boot-starter-thymeleaf")

    testImplementation(testFixtures(project(":core")))
    testImplementation(testFixtures(project(":email")))
}

完全依赖洞察力报告

./gradlew :security:dependencyInsight --configuration compileClasspath --dependency org.javassist:javassist

> Task :security:dependencyInsight
Dependency resolution failed because of conflict(s) on the following module(s):
   - org.javassist:javassist between versions 3.24.0-GA and 3.20.0-GA

org.javassist:javassist:3.24.0-GA
   variant "compile" [
      org.gradle.status              = release (not requested)
      org.gradle.usage               = java-api
      org.gradle.libraryelements     = jar (compatible with: classes)
      org.gradle.category            = library

      Requested attributes not found in the selected variant:
         org.gradle.dependency.bundling = external
         org.gradle.jvm.version         = 11
   ]
   Selection reasons:
      - By conflict resolution : between versions 3.24.0-GA and 3.20.0-GA

org.javassist:javassist:3.24.0-GA
\--- org.hibernate:hibernate-core:5.4.12.Final
     +--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE
     |    \--- project :platform
     |         \--- compileClasspath
     \--- org.springframework.boot:spring-boot-starter-data-jpa:2.2.5.RELEASE
          +--- compileClasspath (requested org.springframework.boot:spring-boot-starter-data-jpa)
          \--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE (*)

org.javassist:javassist:3.20.0-GA -> 3.24.0-GA
\--- ognl:ognl:3.1.12
     \--- org.thymeleaf:thymeleaf:3.0.11.RELEASE
          +--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE
          |    \--- project :platform
          |         \--- compileClasspath
          +--- org.thymeleaf:thymeleaf-spring5:3.0.11.RELEASE
          |    +--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE (*)
          |    \--- org.springframework.boot:spring-boot-starter-thymeleaf:2.2.5.RELEASE
          |         +--- compileClasspath (requested org.springframework.boot:spring-boot-starter-thymeleaf)
          |         \--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE (*)
          \--- org.thymeleaf.extras:thymeleaf-extras-java8time:3.0.4.RELEASE
               +--- org.springframework.boot:spring-boot-dependencies:2.2.5.RELEASE (*)
               \--- org.springframework.boot:spring-boot-starter-thymeleaf:2.2.5.RELEASE (*)

(*) - dependencies omitted (listed previously)

A web-based, searchable dependency report is available by adding the --scan option.

BUILD SUCCESSFUL in 757ms
1 actionable task: 1 executed

Answer 1

不幸的是，这种类型的问题无法通过Gradle Java平台插件解决。该插件创建约束，帮助依赖解决过程获得所需的版本，但它不能消除冲突解决。您所得到的错误是由于冲突解决发生的事实。在这种情况下，您将得到冲突的依赖关系。唯一的解决方案是从您的一阶依赖项中排除这些依赖项，这些依赖项带来了不想要的版本。

要想在全球范围内进行控制，就必须创建一个插件来完成它，然后每个项目都必须应用该插件。我们在星云.分辨率.规则.插件中使用这种方法。不幸的是，我们的插件不支持您的用例，因此不能在这里重用它。

我可能会建议停止使用解决策略:失败-冲突。像Spring这样的库有许多依赖项，在这些依赖项中，可能有冲突解决方案。您需要进行大量的手动调整来解决您的项目。