Skip to content

gradle: exclude constraints when retrieving dependencies #1563

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jul 23, 2025
Merged

gradle: exclude constraints when retrieving dependencies #1563

merged 1 commit into from
Jul 23, 2025

Conversation

jagonalez
Copy link
Contributor

@jagonalez jagonalez commented Jul 21, 2025 •
edited
Loading

Overview

This PR excludes constraints when retrieving dependencies.

One of the API calls we use for retrieving Gradle dependencies also includes "constraints", which get treated as a direct dependency. After reviewing the gradle GitHub issues it seems this used to affect gradle dependencies but they filtered out the constraint dependencies. Any dependencies (direct or transitive) are still reported without issues.

Constraints guide: https://docs.gradle.org/current/userguide/dependency_constraints.html

I did not include tests since the change is specifically to the jsondeps.gradle file and we don't have any testing setup for it. I manually tested the changes, see below

Acceptance criteria

  • dependency constraints are not reported as direct dependencies
  • direct & transitive dependencies which are constrained are still reported

Testing plan

Use this Gradle.build file:

plugins {
    id('java-platform')
}

group = 'com.example.platform'

// allow the definition of dependencies to other platforms like the Spring Boot BOM
javaPlatform.allowDependencies()

repositories {
    mavenCentral()
}

dependencies {
    api('org.springframework.boot:spring-boot-cli:3.4.7')

    constraints {
        api('org.apache.httpcomponents.client5:httpclient5:5.5')
    }
}

check out the master branch:
run gradle -I/path/to/fossa-cli/scripts/jsondeps.gradle jsonDeps
look for RESOLUTIONAPI_JSONDEPS_:_ - then I either copy & paste or use jq on the json snippet
in particular - you'll see org.apache.httpcomponents.client5:httpclient5:5.5 as a direct dependency (resolvedConfigurationDirectComponents)
image

^ this is no bueno

switch to this branch, run the gradle command again, and now you get:
image
mucho better!
and the httpclient dependency still exists:
image

Risks

n/a

Metrics

n/a

References

Ticket: https://fossa.atlassian.net/browse/ANE-2564

Checklist

  • I added tests for this PR's change (or explained in the PR description why tests don't make sense).
  • If this PR introduced a user-visible change, I added documentation into docs/.
  • If this PR added docs, I added links as appropriate to the user manual's ToC in docs/README.ms and gave consideration to how discoverable or not my documentation is.
  • If this change is externally visible, I updated Changelog.md. If this PR did not mark a release, I added my changes into an ## Unreleased section at the top.
  • If I made changes to .fossa.yml or fossa-deps.{json.yml}, I updated docs/references/files/*.schema.json AND I have updated example files used by fossa init command. You may also need to update these if you have added/removed new dependency type (e.g. pip) or analysis target type (e.g. poetry).
  • If I made changes to a subcommand's options, I updated docs/references/subcommands/<subcommand>.md.

@jagonalez jagonalez marked this pull request as ready for review July 21, 2025 23:29
@jagonalez jagonalez requested a review from a team as a code owner July 21, 2025 23:29
@jagonalez jagonalez requested a review from jssblck July 21, 2025 23:29
@jagonalez jagonalez merged commit 9cf32d1 into master Jul 23, 2025
19 checks passed
@jagonalez jagonalez deleted the jg/ane-2564 branch July 23, 2025 16:34
james-fossa added a commit that referenced this pull request Aug 7, 2025
@james-fossa @jagonalez
[ANE-2484][ANE-2503] Actually call Ficus, use --x-snippet-scan as a…
727bf26 
… flag. (#1573)

* gradle: exclude constraints when retrieving dependencies (#1563)

* [ane-2575] scan all layers for os info (#1566)

* scan all layers for os info

* add test

* lint

* accidently on purposed

* whitespace

* typo

* update changelog

* no need to log

* prepare for release

* WIP

* WIP

* Get ficus wired in and at least vaguely tested. More to do to get tests to be coherent.

Now we're cooking with gas:
```
Running Ficus analysis on /Users/jclemer/wam/
[DEBUG] Executing ficus
[DEBUG] Ficus returned 4 errors, 0 debug messages, 1 findings
[WARN] ERROR fingerprint: Read(
      Custom {
          kind: InvalidData,
          error: "binary file detected: /Users/jclemer/wam/.git/index",
      },
  )
[WARN] ERROR fingerprint: Read(
      Custom {
          kind: InvalidData,
          error: "binary file detected: /Users/jclemer/wam/.git/objects/pack/pack-183ce412024750728f9349e31668d39ee389840e.idx",
      },
  )
[WARN] ERROR fingerprint: Read(
      Custom {
          kind: InvalidData,
          error: "binary file detected: /Users/jclemer/wam/.git/objects/pack/pack-183ce412024750728f9349e31668d39ee389840e.pack",
      },
  )
[WARN] ERROR fingerprint: Read(
      Custom {
          kind: InvalidData,
          error: "binary file detected: /Users/jclemer/wam/.git/objects/pack/pack-183ce412024750728f9349e31668d39ee389840e.rev",
      },
  )
FINDING fingerprint: {"analysis_id":15}
Ficus analysis completed successfully with analysis ID: 15
```

* Fixing up formatting

* [ANE-2484] Add ficus to extra-source files

* Fix FICUS_ASSET_POSTFIX to match changed release

* Fix Windows postfix for changed release

* Change themis arch in suffix

---------

Co-authored-by: Jeremy Gonzalez <jeremy@fossa.com>
james-fossa added a commit that referenced this pull request Aug 11, 2025
@james-fossa @jagonalez
[ANE-2484] Download ficus in vendor_download.sh (#1565)
1d7368f 
* [ANE-2484] Download ficus in vendor_download.sh

* [ANE-2484] Listen to shellcheck's wisdom

* [ANE-2484][ANE-2503] Actually call Ficus, use `--x-snippet-scan` as a flag. (#1573)

* gradle: exclude constraints when retrieving dependencies (#1563)

* [ane-2575] scan all layers for os info (#1566)

* scan all layers for os info

* add test

* lint

* accidently on purposed

* whitespace

* typo

* update changelog

* no need to log

* prepare for release

* WIP

* WIP

* Get ficus wired in and at least vaguely tested. More to do to get tests to be coherent.

Now we're cooking with gas:
```
Running Ficus analysis on /Users/jclemer/wam/
[DEBUG] Executing ficus
[DEBUG] Ficus returned 4 errors, 0 debug messages, 1 findings
[WARN] ERROR fingerprint: Read(
      Custom {
          kind: InvalidData,
          error: "binary file detected: /Users/jclemer/wam/.git/index",
      },
  )
[WARN] ERROR fingerprint: Read(
      Custom {
          kind: InvalidData,
          error: "binary file detected: /Users/jclemer/wam/.git/objects/pack/pack-183ce412024750728f9349e31668d39ee389840e.idx",
      },
  )
[WARN] ERROR fingerprint: Read(
      Custom {
          kind: InvalidData,
          error: "binary file detected: /Users/jclemer/wam/.git/objects/pack/pack-183ce412024750728f9349e31668d39ee389840e.pack",
      },
  )
[WARN] ERROR fingerprint: Read(
      Custom {
          kind: InvalidData,
          error: "binary file detected: /Users/jclemer/wam/.git/objects/pack/pack-183ce412024750728f9349e31668d39ee389840e.rev",
      },
  )
FINDING fingerprint: {"analysis_id":15}
Ficus analysis completed successfully with analysis ID: 15
```

* Fixing up formatting

* [ANE-2484] Add ficus to extra-source files

* Fix FICUS_ASSET_POSTFIX to match changed release

* Fix Windows postfix for changed release

* Change themis arch in suffix

---------

Co-authored-by: Jeremy Gonzalez <jeremy@fossa.com>

* Caveperson debug vendor_download

---------

Co-authored-by: Jeremy Gonzalez <jeremy@fossa.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
1 more reviewer

@jssblck jssblck jssblck approved these changes

Reviewers whose approvals may not affect merge requirements
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jagonalez @jssblck