search

ben-manes / gradle-versions-plugin

Gradle plugin to discover dependency updates
Apache License 2.0
3.83k stars 200 forks source link

Moshi "main" artifact is not marked as outdated #433

Open StefMa opened 3 years ago

StefMa commented 3 years ago

I have three moshi artifacts as a dependency:

All of them have (currently) the version 1.9.3. The latest version is 1.11.0.

While in the report moshi-kotlin-codegen and moshi-adapters are marked as outdated, moshi is inside the current dependencies section: Outdated dependencies: Screenshot 2020-10-21 at 10 28 55 Current dependencies: Screenshot 2020-10-21 at 10 30 20

This is strange because all the artifacts are published and maintained by the same people.

ben-manes commented 3 years ago

It's hard to say. Since we defer to Gradle's dependency management it is a bit hidden from us.

This can sometimes occur due to the Gradle cache, where --refresh-dependencies forces Gradle to query with the repositories for the latest version. Typically the cache expires after 24 hours, so usually this skew occurs shortly after a release when it retained some stale metadata.

Other times it is because of bad metadata on a repository. For example JCenter will proxy explicit versions to Maven Central, but not dynamic versions. Thus a + version will observe a stale maven-metadata.xml and give wrong results. This most often occurs when a project is listed on JCenter, e.g. so that the authors can observe the download stats, but the dependency is released to Central and it skews over time. I don't see anything quirky on JCenter, if that was the case.

Another possibility is if you have a resolution strategy that rejected a version. This might force com.squareup.moshi:moshi but not its sibling dependencies. Gradle now resolves that by being able to declare them together as "platform dependencies" to tie their versions together. Without that, when resolving the resolution strategy might force moshi to your current version while allowing us to detect updates to the others. This is the most likely culprit, and you could skip your rules, e.g. by querying the task graph.