Gradle downloads unrequired dependencies

Question

I'm trying to download using Gradle my freshly published dependency from Maven Central:

repositories {
  mavenCentral()
}

dependencies {
  implementation 'io.github.iltotore:ec-client_2.13:1.0-fixed'
}

When trying to build, I get an error:

Could not find io.github.iltotore:core:1.0-fixed.
Required by:
    project : > io.github.iltotore:ec-client_2.13:1.0-fixed

But io.github.iltotore:core:1.0-fixed is not in the lib's pom and my friends can use it without any error.

To solve this problem, I tried:

• running gradlew build --refresh-dependency

• deleting caches in ~/.gradle/

• invalidate caches with Intellij IDEA

• deleting my maven local

but this issue is still here.

I use Gradle 6.5 with Intellij IDEA 2020.1.2.

Answer 1

Since Gradle 6.0, the Maven Publish plugin will also publish Gradle Module Metadata. The metadata has the file extension .module and you can see it in the repository here.

If you open the pom file, you will notice that in the top there is a comment saying:

<!--  This module was also published with a richer model, Gradle metadata,   -->
<!--  which should be used instead. Do not delete the following line which   -->
<!--  is to indicate to Gradle or any Gradle module metadata file consumer   -->
<!--  that they should prefer consuming it instead.  -->
<!--  do_not_remove: published-with-gradle-metadata  -->

This instructs Gradle to use the metadata file instead of the pom file.

If you open the metadata file, you can see that it indeed has a dependency to the non-existing module:

"dependencies": [
    ...
    {
        "group": "io.github.iltotore",
        "module": "core",
        "version": {
            "requires": "1.0-fixed"
        }
    }
]

Since core doesn't exist in any version, I expect that this is a mistake. Maybe you are customizing the pom file, but didn't do it for the module metadata.

There are several ways you can fix this (all the following snippets is for the Groovy DSL).

A. Publish a new version without the module metadata

This way you rely solely on the pom file. You can do that by something like:

tasks.withType(GenerateModuleMetadata) {
    enabled = false
}

See Understanding Gradle Module Metadata in the Gradle user guide.

B. Disable the module metadata in the repository in the consuming project

Note that this takes effect for all modules, and not just the broken one:

repositories {
    mavenCentral {
        metadataSources {
            mavenPom()
            artifact()
            ignoreGradleMetadataRedirection()
        }
    }
}

See Declaring repositories in the Gradle user guide.

C. Correct the metadata on the consuming side for this particular dependency

Something like:

dependencies {
    dependencies {
        components {
            // Fix wrong dependency in client_2.13
            withModule("io.github.iltotore:ec-client_2.13") {
                allVariants {
                    withDependencies {
                        removeAll { it.group == "io.github.iltotore" && it.name == "core" }
                    }
                }
            }
        }
    }

    implementation 'io.github.iltotore:ec-client_2.13:1.0-fixed'
}

See Fixing metadata with component metadata rules in the Gradle user guide.