Version conflict for nested dependency when using versions from platform

My project contains several sub-projects, and I use a common platform to define version constraints for all of them so that I only have one place to maintain the versions (similar to a properties block with Maven), and so that I can move some of the nastier hacks out of the individual projects.

I run Gradle 6.5.1.

(UPDATE: The projects that fail are my three WAR projects, which use providedCompile to define their dependencies. According to a scan the conflict happens inside the providedRuntime configuration)

In one of my projects the build fails if I remove the version for one of the dependencies.
OK: implementation 'jmimemagic:jmimemagic:0.1.2'
Not OK: implementation 'jmimemagic:jmimemagic'

According to the “dependencies” task, the failure is related to xml-apis. I added some snippets below.
I’d like to resolve the dependencies based on my platform constraints, and I’d like to include nested/transitive dependencies in that. This doesn’t seem to work as anticipated.

How can I make sure that, in this example, the versions for jmimemagic and xml-apis are set as defined in the platform, without causing a failure? xml-apis-ext seems to be part of the problem.

Thank you!

The interesting lines of this platform:

dependencies { constraints {
runtime('xml-apis:xml-apis') { version {
    strictly '[1.4.01,2.0.0['
    reject '2.0.0'
    reject '2.0.2'
    because '1.4.01 is more recent than 2.x'
} }
api 'jmimemagic:jmimemagic:0.1.2'
}

Some snippets from the “dependencies” task:
OK:

|    \--- xerces:xercesImpl -> 2.11.0
|         \--- xml-apis:xml-apis:1.4.01

[…]

|    |    |    |    |    +--- jmimemagic:jmimemagic:0.1.2
|    |    |    |    |    |    +--- oro:oro:2.0.8
|    |    |    |    |    |    +--- commons-logging:commons-logging:1.0.4 -> 1.2
|    |    |    |    |    |    +--- xerces:xercesImpl:2.7.1 -> 2.11.0 (*)
|    |    |    |    |    |    \--- xml-apis:xml-apis:2.0.2 -> 1.4.01

[…]

|    |    |    |    |    +--- org.apache.xmlgraphics:batik-dom:1.11
|    |    |    |    |    |    +--- org.apache.xmlgraphics:batik-css:1.11 (*)
|    |    |    |    |    |    +--- org.apache.xmlgraphics:batik-ext:1.11
|    |    |    |    |    |    +--- org.apache.xmlgraphics:batik-util:1.11 (*)
|    |    |    |    |    |    +--- org.apache.xmlgraphics:batik-xml:1.11
|    |    |    |    |    |    |    \--- org.apache.xmlgraphics:batik-util:1.11 (*)
|    |    |    |    |    |    +--- xml-apis:xml-apis:1.3.04 -> 1.4.01
|    |    |    |    |    |    \--- xml-apis:xml-apis-ext:1.3.04

Not OK:

|    \--- xerces:xercesImpl -> 2.11.0
|         \--- xml-apis:xml-apis:1.4.01 FAILED

[…]

|    |    |    |    |    +--- jmimemagic:jmimemagic -> 0.1.2
|    |    |    |    |    |    +--- oro:oro:2.0.8
|    |    |    |    |    |    +--- commons-logging:commons-logging:1.0.4 -> 1.2
|    |    |    |    |    |    +--- xerces:xercesImpl:2.7.1 -> 2.11.0 (*)
|    |    |    |    |    |    \--- xml-apis:xml-apis:2.0.2 FAILED

[…]

|    |    |    |    |    +--- org.apache.xmlgraphics:batik-dom:1.11
|    |    |    |    |    |    +--- org.apache.xmlgraphics:batik-css:1.11 (*)
|    |    |    |    |    |    +--- org.apache.xmlgraphics:batik-ext:1.11
|    |    |    |    |    |    +--- org.apache.xmlgraphics:batik-util:1.11 (*)
|    |    |    |    |    |    +--- org.apache.xmlgraphics:batik-xml:1.11
|    |    |    |    |    |    |    \--- org.apache.xmlgraphics:batik-util:1.11 (*)
|    |    |    |    |    |    +--- xml-apis:xml-apis:1.3.04 FAILED
|    |    |    |    |    |    \--- xml-apis:xml-apis-ext:1.3.04

dependencyInsight for xml-apis:

xml-apis:xml-apis:1.3.04 (by ancestor) FAILED
   Failures:
      - Could not resolve xml-apis:xml-apis:1.3.04.
          - Cannot find a version of 'xml-apis:xml-apis' that satisfies the version constraints:
               Dependency path 'com.xxx.a:22.0.0-RC1-SNAPSHOT' --> 'com.xxx.b:22.0.0-RC1-SNAPSHOT' --> 'org.springframework.security.extensions:spring-security-saml2-core:1.0.3.RELEASE' --> 'xml-apis:xml-apis:1.4.01'
               Dependency path 'com.xxx.a:22.0.0-RC1-SNAPSHOT' --> 'com.xxx.core:22.0.0-RC1-SNAPSHOT' --> 'xerces:xercesImpl:2.11.0' --> 'xml-apis:xml-apis:1.4.01'
               Constraint path 'com.xxx.a:22.0.0-RC1-SNAPSHOT' --> 'com.xxx.core:22.0.0-RC1-SNAPSHOT' --> 'com.xxx.platform:22.0.0-RC1-SNAPSHOT' --> 'xml-apis:xml-apis:{strictly [1.4.01,2.0.0[; reject 2.0.2}' because of the following reason: 1.4.01 is more recent than 2.x
               Dependency path 'com.xxx.a:22.0.0-RC1-SNAPSHOT' --> 'com.xxx.c:22.0.0-RC1-SNAPSHOT' --> 'org.apache.xmlgraphics:batik-transcoder:1.11' --> 'org.apache.xmlgraphics:batik-dom:1.11' --> 'xml-apis:xml-apis:1.3.04'
               Dependency path 'com.xxx.a:22.0.0-RC1-SNAPSHOT' --> 'com.xxx.d:22.0.0-RC1-SNAPSHOT' --> 'jmimemagic:jmimemagic:0.1.2' --> 'xml-apis:xml-apis:2.0.2'

This only happens if I pull in the other dependencies using providedCompile (WAR plugin). If I change this to implementation, everything is OK.

Somewhat minimal, reproducible example:

./gradlew xxx-a:build fails. This can be fixed if I change providedCompile project(':xxx-f') to implementation project(':xxx-f') in xxx:a. The problem also disappears when I use implementation 'jmimemagic:jmimemagic:0.1.2' in xxx-f.

> Could not resolve all files for configuration ':xxx-a:providedRuntime'.
   > Could not resolve xml-apis:xml-apis.
     Required by:
         project :xxx-a > project :xxx-e
      > Cannot find a version of 'xml-apis:xml-apis' that satisfies the version constraints:
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-e:1.0.0' --> 'xml-apis:xml-apis'
           Constraint path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-b:1.0.0' --> 'com.xxx:xxx-platform:1.0.0' --> 'xml-apis:xml-apis:{strictly [1.4.01,2.0.0[; prefer 1.4.01}' because of the following reason: 1.4.01 is more recent than 2.x
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-f:1.0.0' --> 'jmimemagic:jmimemagic:0.1.2' --> 'xml-apis:xml-apis:2.0.2'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-g:1.0.0' --> 'org.springframework.security.extensions:spring-security-saml2-core:1.0.3.RELEASE' --> 'xml-apis:xml-apis:1.4.01'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-e:1.0.0' --> 'xerces:xercesImpl:2.11.0' --> 'xml-apis:xml-apis:1.4.01'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-d:1.0.0' --> 'org.apache.xmlgraphics:batik-transcoder:1.11' --> 'org.apache.xmlgraphics:batik-dom:1.11' --> 'xml-apis:xml-apis:1.3.04'

   > Could not resolve xml-apis:xml-apis:{strictly [1.4.01,2.0.0[; prefer 1.4.01}.
     Required by:
         project :xxx-a > project :xxx-b > project :xxx-platform
      > Cannot find a version of 'xml-apis:xml-apis' that satisfies the version constraints:
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-e:1.0.0' --> 'xml-apis:xml-apis'
           Constraint path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-b:1.0.0' --> 'com.xxx:xxx-platform:1.0.0' --> 'xml-apis:xml-apis:{strictly [1.4.01,2.0.0[; prefer 1.4.01}' because of the following reason: 1.4.01 is more recent than 2.x
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-f:1.0.0' --> 'jmimemagic:jmimemagic:0.1.2' --> 'xml-apis:xml-apis:2.0.2'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-g:1.0.0' --> 'org.springframework.security.extensions:spring-security-saml2-core:1.0.3.RELEASE' --> 'xml-apis:xml-apis:1.4.01'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-e:1.0.0' --> 'xerces:xercesImpl:2.11.0' --> 'xml-apis:xml-apis:1.4.01'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-d:1.0.0' --> 'org.apache.xmlgraphics:batik-transcoder:1.11' --> 'org.apache.xmlgraphics:batik-dom:1.11' --> 'xml-apis:xml-apis:1.3.04'

   > Could not resolve xml-apis:xml-apis:2.0.2.
     Required by:
         project :xxx-a > project :xxx-f > jmimemagic:jmimemagic:0.1.2
      > Cannot find a version of 'xml-apis:xml-apis' that satisfies the version constraints:
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-e:1.0.0' --> 'xml-apis:xml-apis'
           Constraint path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-b:1.0.0' --> 'com.xxx:xxx-platform:1.0.0' --> 'xml-apis:xml-apis:{strictly [1.4.01,2.0.0[; prefer 1.4.01}' because of the following reason: 1.4.01 is more recent than 2.x
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-f:1.0.0' --> 'jmimemagic:jmimemagic:0.1.2' --> 'xml-apis:xml-apis:2.0.2'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-g:1.0.0' --> 'org.springframework.security.extensions:spring-security-saml2-core:1.0.3.RELEASE' --> 'xml-apis:xml-apis:1.4.01'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-e:1.0.0' --> 'xerces:xercesImpl:2.11.0' --> 'xml-apis:xml-apis:1.4.01'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-d:1.0.0' --> 'org.apache.xmlgraphics:batik-transcoder:1.11' --> 'org.apache.xmlgraphics:batik-dom:1.11' --> 'xml-apis:xml-apis:1.3.04'

   > Could not resolve xml-apis:xml-apis:1.4.01.
     Required by:
         project :xxx-a > project :xxx-g > org.springframework.security.extensions:spring-security-saml2-core:1.0.3.RELEASE
         project :xxx-a > project :xxx-e > xerces:xercesImpl:2.11.0
      > Cannot find a version of 'xml-apis:xml-apis' that satisfies the version constraints:
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-e:1.0.0' --> 'xml-apis:xml-apis'
           Constraint path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-b:1.0.0' --> 'com.xxx:xxx-platform:1.0.0' --> 'xml-apis:xml-apis:{strictly [1.4.01,2.0.0[; prefer 1.4.01}' because of the following reason: 1.4.01 is more recent than 2.x
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-f:1.0.0' --> 'jmimemagic:jmimemagic:0.1.2' --> 'xml-apis:xml-apis:2.0.2'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-g:1.0.0' --> 'org.springframework.security.extensions:spring-security-saml2-core:1.0.3.RELEASE' --> 'xml-apis:xml-apis:1.4.01'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-e:1.0.0' --> 'xerces:xercesImpl:2.11.0' --> 'xml-apis:xml-apis:1.4.01'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-d:1.0.0' --> 'org.apache.xmlgraphics:batik-transcoder:1.11' --> 'org.apache.xmlgraphics:batik-dom:1.11' --> 'xml-apis:xml-apis:1.3.04'

   > Could not resolve xml-apis:xml-apis:1.3.04.
     Required by:
         project :xxx-a > project :xxx-d > org.apache.xmlgraphics:batik-transcoder:1.11 > org.apache.xmlgraphics:batik-dom:1.11
      > Cannot find a version of 'xml-apis:xml-apis' that satisfies the version constraints:
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-e:1.0.0' --> 'xml-apis:xml-apis'
           Constraint path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-b:1.0.0' --> 'com.xxx:xxx-platform:1.0.0' --> 'xml-apis:xml-apis:{strictly [1.4.01,2.0.0[; prefer 1.4.01}' because of the following reason: 1.4.01 is more recent than 2.x
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-f:1.0.0' --> 'jmimemagic:jmimemagic:0.1.2' --> 'xml-apis:xml-apis:2.0.2'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-g:1.0.0' --> 'org.springframework.security.extensions:spring-security-saml2-core:1.0.3.RELEASE' --> 'xml-apis:xml-apis:1.4.01'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-e:1.0.0' --> 'xerces:xercesImpl:2.11.0' --> 'xml-apis:xml-apis:1.4.01'
           Dependency path 'com.xxx:xxx-a:1.0.0' --> 'com.xxx:xxx-d:1.0.0' --> 'org.apache.xmlgraphics:batik-transcoder:1.11' --> 'org.apache.xmlgraphics:batik-dom:1.11' --> 'xml-apis:xml-apis:1.3.04'

Solved! The xxx-platform wasn’t known to the providedCompile (and, thus, providedRuntime?) configuration in xxx-a. Everything works as soon as I add
providedCompile platform(project(':xxx-platform')) to xxx-a.