Gradle: cycles in dependency insight report

Question

Trying to upgrade some javax to jakarta libraries, I ran into version conflicts. In particular, one of my libraries (jOOQ) that I need to update requires version 3.0.0 of jakarta.xml.bind:jakarta.xml.bind-api (which is in the jarkarta namespace), but the jackson xml libraries still require the old 2.3.3 (which is in the javax namespace).

Apart from not knowing how to resolve the situation, I got further confused by the following dependencyInsight report (generated with ::dependencyInsight --configuration compileClasspath --dependency jakarta.xml.bind:jakarta.xml.bind-api):

jakarta.xml.bind:jakarta.xml.bind-api:3.0.0
\--- org.jooq.pro-java-11:jooq:3.16.5
     \--- compileClasspath

jakarta.xml.bind:jakarta.xml.bind-api:2.3.3 -> 3.0.0
\--- com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.13.4
     +--- org.glassfish.jersey.media:jersey-media-json-jackson:2.36 (requested com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.13.3)
     |    +--- compileClasspath (requested org.glassfish.jersey.media:jersey-media-json-jackson)
     |    \--- org.glassfish.jersey:jersey-bom:2.36
     |         \--- compileClasspath
     \--- com.fasterxml.jackson:jackson-bom:2.13.4
          +--- compileClasspath
          +--- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.13.4
          |    +--- compileClasspath
          |    \--- com.fasterxml.jackson:jackson-bom:2.13.4 (*)
          +--- com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.13.4 (*)
          +--- com.fasterxml.jackson.core:jackson-databind:2.13.4
          |    +--- compileClasspath (requested com.fasterxml.jackson.core:jackson-databind)
          |    +--- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.13.4 (*)
          |    +--- org.glassfish.jersey.media:jersey-media-json-jackson:2.36 (requested com.fasterxml.jackson.core:jackson-databind:2.13.3) (*)
          |    +--- com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.13.4 (*)
          |    \--- com.fasterxml.jackson:jackson-bom:2.13.4 (*)
          +--- com.fasterxml.jackson.core:jackson-annotations:2.13.4
          |    +--- compileClasspath (requested com.fasterxml.jackson.core:jackson-annotations)
          |    +--- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.13.4 (*)
          |    +--- org.glassfish.jersey.media:jersey-media-json-jackson:2.36 (requested com.fasterxml.jackson.core:jackson-annotations:2.13.3) (*)
          |    +--- com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.13.4 (*)
          |    +--- com.fasterxml.jackson.core:jackson-databind:2.13.4 (*)
          |    \--- com.fasterxml.jackson:jackson-bom:2.13.4 (*)
          \--- com.fasterxml.jackson.core:jackson-core:2.13.4
               +--- compileClasspath (requested com.fasterxml.jackson.core:jackson-core)
               +--- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.13.4 (*)
               +--- com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.13.4 (*)
               +--- com.fasterxml.jackson.core:jackson-databind:2.13.4 (*)
               \--- com.fasterxml.jackson:jackson-bom:2.13.4 (*)

(*) - dependencies omitted (listed previously)

As you can see, there are unexpected entries in the report:

com.fasterxml.jackson:jackson-bom:2.13.4 seems to depend on itself (i.e. cycles).
Other libraries like om.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.13.4 seem to depend on com.fasterxml.jackson:jackson-bom:2.13.4 although I can't find that dependency when inspecting the POM file.

Can someone explain why the dependency insight report is generated that way? And, ultimately, do you have any hints at how I can get the jackson xml stuff to work with jakarta xml bindings?

Gradle: cycles in dependency insight report

0 Answers