[THRIFT-1919] libthrift depends on httpcore-4.1.3 (directly) and httpcore-4.1.4 (transitively)

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 0.9
• Fix Version/s: 0.9.1
• Component/s: Java - Library
• Labels: conflict convergence gradle httpclient httpcore libthrift maven

Environment

Windows x64 + Maven or Gradle.

• Assignee: Jake Farrell
• Reporter: Ryan
• Created: 07/Apr/13 03:43
• Updated: 21/Jun/13 20:55
• Resolved: 21/Jun/13 19:37

Description

I believe this is the same issue as THRIFT-1693, but with different versions. There's a direct dependency on both httpclient and httpcore version 4.1.3 in thriftlib, but httpclient:4.1.3 has a dependency on httpcore:4.1.4.

Here are the dependencies Gradle shows me.

\--- org.apache.thrift:libthrift:0.9.0
     +--- org.slf4j:slf4j-api:1.5.8
     +--- commons-lang:commons-lang:2.5
     +--- org.apache.httpcomponents:httpclient:4.1.3
     |    +--- org.apache.httpcomponents:httpcore:4.1.4
     |    +--- commons-logging:commons-logging:1.1.1
     |    \--- commons-codec:commons-codec:1.4
     \--- org.apache.httpcomponents:httpcore:4.1.3 -> 4.1.4 (*)

Here's a copy of the dependency resolution section of my Gradle build in case anyone needs a short term workaround. The force option is what allows the direct dependency to be overridden to 4.1.4 (shown with a * in the above snippet).

all {
    resolutionStrategy {
        // fails when multiple versions of the same dependency exist (this includes
        // transitive dependencies)
        failOnVersionConflict()

        // don't cache snapshot / changing modules
        cacheChangingModulesFor 0, 'seconds'

        // force httpcore to 4.1.4 to avoid version conflict
        force "org.apache.httpcomponents:httpcore:4.1.4"
    }
}