Skip to content

Conversation

ivanauth
Copy link
Contributor

Summary

Resolves dependency conflicts introduced in #151 that cause maven-enforcer-plugin convergence failures for downstream Maven users.

Changes

  • Add exclusion for proto-google-common-protos from grpc-protobuf to prevent version 2.59.2 from conflicting with 2.61.3
  • Add exclusions to protovalidate and pgv-java-stub for transitive dependencies that conflict with SDK versions
  • Explicitly declare aligned versions:
    • protobuf-java: 4.32.1
    • protobuf-java-util: 4.32.1
    • proto-google-common-protos: 2.61.3
    • gson: 2.11.0
    • re2j: 1.8

Testing

  • Build completed successfully: ./gradlew clean build
  • Verified dependency convergence with ./gradlew dependencies --configuration runtimeClasspath
  • All conflicting dependencies now resolve to single versions

Fixes dependency convergence errors reported by users upgrading to v1.5.2.

Add exclusions and explicit versions to resolve conflicts from authzed#151
@ivanauth ivanauth requested a review from a team as a code owner October 10, 2025 18:15
@ivanauth
Copy link
Contributor Author

ivanauth commented Oct 15, 2025

Generated POM Comparison

here's what changes in the Maven POM:

Before (main): protovalidate and pgv-java-stub have no exclusions

After (this PR): Both dependencies exclude conflicting transitives, and explicit versions are declared

View POM diff
   <dependency>
     <groupId>build.buf</groupId>
     <artifactId>protovalidate</artifactId>
     <version>1.0.0</version>
     <scope>runtime</scope>
+    <exclusions>
+      <exclusion>
+        <groupId>com.google.protobuf</groupId>
+        <artifactId>protobuf-java</artifactId>
+      </exclusion>
+      <exclusion>
+        <groupId>com.google.code.gson</groupId>
+        <artifactId>gson</artifactId>
+      </exclusion>
+      <exclusion>
+        <groupId>com.google.protobuf</groupId>
+        <artifactId>protobuf-java-util</artifactId>
+      </exclusion>
+      <exclusion>
+        <groupId>com.google.re2j</groupId>
+        <artifactId>re2j</artifactId>
+      </exclusion>
+    </exclusions>
   </dependency>
   <dependency>
     <groupId>build.buf.protoc-gen-validate</groupId>
     <artifactId>pgv-java-stub</artifactId>
     <version>1.2.1</version>
     <scope>runtime</scope>
+    <exclusions>
+      <exclusion>
+        <groupId>com.google.protobuf</groupId>
+        <artifactId>protobuf-java</artifactId>
+      </exclusion>
+      <exclusion>
+        <groupId>com.google.code.gson</groupId>
+        <artifactId>gson</artifactId>
+      </exclusion>
+      <exclusion>
+        <groupId>com.google.protobuf</groupId>
+        <artifactId>protobuf-java-util</artifactId>
+      </exclusion>
+      <exclusion>
+        <groupId>com.google.re2j</groupId>
+        <artifactId>re2j</artifactId>
+      </exclusion>
+    </exclusions>
   </dependency>
+  <dependency>
+    <groupId>com.google.protobuf</groupId>
+    <artifactId>protobuf-java-util</artifactId>
+    <version>4.32.1</version>
+    <scope>runtime</scope>
+  </dependency>
+  <dependency>
+    <groupId>com.google.code.gson</groupId>
+    <artifactId>gson</artifactId>
+    <version>2.11.0</version>
+    <scope>runtime</scope>
+  </dependency>
+  <dependency>
+    <groupId>com.google.re2j</groupId>
+    <artifactId>re2j</artifactId>
+    <version>1.8</version>
+    <scope>runtime</scope>
+  </dependency>

This ensures Maven sees only one version of each library, passing enforcer convergence checks.

Copy link
Contributor

@tstirrat15 tstirrat15 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice. Thank you!

@tstirrat15 tstirrat15 added this pull request to the merge queue Oct 15, 2025
Merged via the queue into authzed:main with commit c76b9c9 Oct 15, 2025
8 checks passed
@github-actions github-actions bot locked and limited conversation to collaborators Oct 15, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants