The plugin fails to run with Gradle 9

[sergeykad]

The plugin fails to run with Gradle 9

The problem occurs with version 12.1.3 of the Gradle plugin

Log file
https://gist.github.com/sergeykad/14076a4695a12590936c51314776cd7f

Error:
org.gradle.api.internal.artifacts.configurations.DefaultConfiguration$IllegalResolutionException: Resolution of the configuration ':abstract-function-plugin:errorproneJavac' was attempted without an exclusive lock. This is unsafe and not allowed.

Steps to reproduce the behavior:

• Install Gradle 9.0.0
• Run gradle dependencyCheckAggregate
• See the error

Expected behavior

• No error is reported, and a dependencies report is generated.

Additional context
dependency-check/DependencyCheck#7850

As mentioned by @raphiz, this issue is related to a change in Gradle concurrency model.
Related discussions:

ben-manes/gradle-versions-plugin#948 (comment)
gradle/gradle#33938 (comment)

[pavelvodrazka]

I have exactly the same problem with the latest version and Gradle 9:

Execution failed for task ':dependencyCheckAggregate'.
> Resolution of the configuration ':app-data:annotationProcessor' was attempted without an exclusive lock. This is unsafe and not allowed.
* Try:
> For more information, please refer to https://docs.gradle.org/9.0.0/userguide/viewing_debugging_dependencies.html#sub:resolving-unsafe-configuration-resolution-errors in the Gradle documentation.

[chadlwilson]

As with the linked projects this appears to be specific to those who have org.gradle.parallel enabled by default in their gradle.properties.

The best workaround for this in the context of dependency check is running with

./gradlew dependencyCheckAggregate --no-parallel

You also might need to add --no-configuration-cache if you also have the optional config cache enabled in your Gradle properties.

In the context of a large multi-project build I've fiound dependency check doesn't benefit much from parallelism in Gradle itself and has its own internal parallelism when processing the NVD/etc/Gradle results anyway. If you're running dep check in the same run as other tasks which do benefit from parallelism, you might want to split it out.

It seems to work fine on Gradle 9 without parallelism.

There are some other workarounds by manually defining dependencies between dependencyCheckAggregate and the relevant subproject tasks/configurations but this is difficult in the generic case (potentially with custom configurations that dep check looks at, android etc).

[PaulFridrick]

Here is the explanation from the Gradle documentation of why this is an issue, and some directions to try and fix it.

[chadlwilson]

FWIW this is essentially the Gradle 9 realization of #346