Libraries specified in constraints should be kept

[frangipanes]

If I define a constraints block like this

dependencies {
    // force versions of transitive dependencies that don't have security vulnerabilities
    constraints {
            implementation libs.commons.beanutils
            implementation libs.jackson.databind
    }
    ...
}

then ./gradlew versionCatalogUpdate should not remove those libraries from libs.versions.toml, which it currently does (it thinks they are not used).

For now I am forcing the desired behaviour with

versionCatalogUpdate {
    keep {
        keepUnusedVersions = true
        keepUnusedLibraries = true
        keepUnusedPlugins = true
    }
}

but it should work out of the box.

[hvisser]

The dependency resolution is managed by the version plugin, not this plugin. Have you tried specifying constraints as specified in their docs? If the dependency versions plugin does not report those dependencies as used, they won't be seen by this plugin either because it builds upon it.

You don't really need to keep everything, you can just pin or keep the specific libraries too

[frangipanes]

Thanks, I didn't realise it was something I had to configure for the versions plugin!