How to use plugin with different dependency versions

[BranislavBeno]

Hi, when I generate Gradle lock-file, it contains following records:

com.fasterxml.jackson.core:jackson-databind:2.12.4=jsonschema2dataclass,jsonschema2dataclassPlugins
com.fasterxml.jackson.core:jackson-databind:2.16.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

I would like to use recent com.fasterxml.jackson.core:jackson-databind dependency version (2.16.1) for jsonschema2dataclass and jsonschema2dataclassPlugins as well.

I have tried to extend my gradle-kotlin-dsl script:

dependencies {
    ...
    implementation("com.fasterxml.jackson.core:jackson-databind:2.16.1")
    jsonschema2dataclass("com.fasterxml.jackson.core:jackson-databind:2.16.1")
    jsonschema2dataclassPlugins("com.fasterxml.jackson.core:jackson-databind:2.16.1")
}

This change was accepted by Gradle, and I'm able to generate Gradle lock-file successfully, which looks now:

com.fasterxml.jackson.core:jackson-databind:2.16.1=compileClasspath,jsonschema2dataclass,jsonschema2dataclassPlugins,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

However, when I try to build the project, I'm getting the following error:

Execution failed for task 'generateJsonSchema2DataClassConfigMain'.
> A failure occurred while executing org.jsonschema2dataclass.js2p.Js2pWorker
   > org/jsonschema2pojo/GenerationConfig

I'm using plugin version 6.0.0 with Gradle 8.5 and Java 17

[eirnym]

Hi there,

Thank you for your question. I see in it a lack of proper explanation in the plugin documentation.

Both configurations jsonschema2dataclass and jsonschema2dataclassPlugins are controlling dependencies for plugin itself. These configurations are not meant to be used as application dependencies.

Configuration jsonschema2dataclass contains only dependency for jsonschema2pojo by default if this processor is used (current default). Thus if you add something, the original dependency will perish, which is the reason you observe a failure. This has been done this way for an ability to upgrade or downgrade jsonschema2pojo processor library if it's not upgraded via plugin for some reason.

To update or add other plugin dependencies it's mean to be used only jsonschema2dataclassPlugins configuration.

so I'd rewrite your DLS as such:

dependencies {
    // ...
    implementation("com.fasterxml.jackson.core:jackson-databind:2.16.1")
     // If upgrade of jsonschema2pojo is needed. I haven't tried if this is still compatible (I hope so)
    jsonschema2dataclass("org.jsonschema2pojo:jsonschema2pojo:1.2.1")
    // If upgrade of jackson databind for plugin is needed:
    jsonschema2dataclassPlugins("com.fasterxml.jackson.core:jackson-databind:2.16.1")
}

[BranislavBeno]

Hi @eirnym ,

thank you for quick response.
I really appreciate that.

I have followed your suggestion, which partially solved my problem.
In particular:
jsonschema2dataclassPlugins("com.fasterxml.jackson.core:jackson-databind:2.16.1")
has worked as expected.
On the other hand, usage of jsonschema2dataclass("org.jsonschema2pojo:jsonschema2pojo:1.2.1") ends with the same error as before.

How about to release new version of your nifty plugin, in which vulnerable dependencies will be replaced with recent?

[eirnym]

@BranislavBeno Thank for your response. I'll look into it.

Also, this plugin doesn't directly depend on Jackson databind, and version came from jsonschema2pojo processor.

[eirnym]

@BranislavBeno for a release I've setup a milestone for that.

[BranislavBeno]

Thank you, @eirnym.