How to debug why Gradle picked a certain dependency version

Help/Discuss
1

Hi! I have a project that kind of grew faster than my understanding of Gradle, and now I can’t quite figure out why it’s working the way it is.

In particular, I have a transitive dependency to liquibase-core that Gradle resolves to 4.5.0, even though the packages that actually depend on it seem to depend on 4.9.1, and I can’t figure out why.

This is what a build scan shows:

image
image558×607 49.7 KB

Note that detachedConfiguration41 asks for 4.5.0. I can’t figure out how to determine where that version came from.

When running gradle -q dependencies the only occurrence is this:

+--- com.atlassian.connect:atlassian-connect-spring-boot-jpa-starter:2.3.6
|    +--- org.liquibase:liquibase-core:4.9.1 -> 4.5.0
|    |    \--- javax.xml.bind:jaxb-api:2.3.0 -> 2.3.1
|    |         \--- javax.activation:javax.activation-api:1.2.0

Running it with --debug I get this output:

[DEBUG] [io.spring.gradle.dependencymanagement.internal.VersionConfiguringAction] Processing dependency ‘org.liquibase:liquibase-core:4.9.1’
[DEBUG] [io.spring.gradle.dependencymanagement.internal.DependencyManagementContainer] Found managed version ‘4.5.0’ for dependency ‘org.liquibase:liquibase-core’ in global dependency management
[DEBUG] [io.spring.gradle.dependencymanagement.internal.VersionConfiguringAction] Using version ‘4.5.0’ for dependency ‘org.liquibase:liquibase-core:4.9.1’

Any idea where that “global dependency management” found the 4.5.0 version?

2

You use Spring Boot 2.6 and the Spring Dependency Management plugin.
The Spring Boot 2.6 BOM says you should use liquibase-core 4.5.0 and the Spring Dependency Management plugin hooks deeply into the resolution engine to enforce that in a hard-to-discover way.

You should remove the Spring Dependency Management plugin, it is a relict from a time when Gradle had no built-in BOM support and even its maintainer recommends to not use it anymore, but use the built-in BOM support with platform(...) instead. With that it would also have been obvious where the version comes from.

1 Like
3

Thank you very much, I’ll try your suggestion.