Provide streamlined dependency management to avoid conflicting dependencies

[jjank]

Is your feature request related to a problem? Please describe

Hi there,

I'm using the google-api-services-youtube library in one of my projects and noticed (by means of the maven-enforcer-plugin- specifically the dependency convergence rule) that there are a number of conflicting dependencies.

Specifically google-api-services-youtube as of version v3-rev20250224-2.0.0 effectively brings 3 ⚠ different versions of com.google.http-client:google-http-client:

• com.google.http-client:google-http-client:jar:1.43.3
• com.google.http-client:google-http-client:jar:1.45.0
• com.google.http-client:google-http-client:jar:1.45.2

This is the full output of the enforcer plugin:

[ERROR] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed with message:
[ERROR] Failed while enforcing releasability.
[ERROR] 
[ERROR] Dependency convergence error for com.google.http-client:google-http-client-gson:jar:1.43.3 paths to dependency are:
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-com.google.oauth-client:google-oauth-client:jar:1.36.0:compile
[ERROR]         +-com.google.http-client:google-http-client-gson:jar:1.43.3:compile
[ERROR] and
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-com.google.auth:google-auth-library-oauth2-http:jar:1.30.0:compile
[ERROR]         +-com.google.http-client:google-http-client-gson:jar:1.45.0:compile
[ERROR] and
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-com.google.http-client:google-http-client-gson:jar:1.45.2:compile
[ERROR] 
[ERROR] 
[ERROR] Dependency convergence error for commons-codec:commons-codec:jar:1.17.1 paths to dependency are:
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-commons-codec:commons-codec:jar:1.17.1:compile
[ERROR] and
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-org.apache.httpcomponents:httpclient:jar:4.5.14:compile
[ERROR]         +-commons-codec:commons-codec:jar:1.11:compile
[ERROR] 
[ERROR] 
[ERROR] Dependency convergence error for com.google.guava:guava:jar:31.1-android paths to dependency are:
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-com.google.oauth-client:google-oauth-client:jar:1.36.0:compile
[ERROR]         +-com.google.guava:guava:jar:31.1-android:compile
[ERROR] and
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-com.google.auth:google-auth-library-oauth2-http:jar:1.30.0:compile
[ERROR]         +-com.google.guava:guava:jar:33.3.1-android:compile
[ERROR] and
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-com.google.guava:guava:jar:33.1.0-jre:compile
[ERROR] 
[ERROR] 
[ERROR] Dependency convergence error for com.google.http-client:google-http-client:jar:1.43.3 paths to dependency are:
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-com.google.oauth-client:google-oauth-client:jar:1.36.0:compile
[ERROR]         +-com.google.http-client:google-http-client:jar:1.43.3:compile
[ERROR] and
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-com.google.auth:google-auth-library-oauth2-http:jar:1.30.0:compile
[ERROR]         +-com.google.http-client:google-http-client:jar:1.45.0:compile
[ERROR] and
[ERROR] +-com.github.jjank.example:yt-dependency-conflicts:jar:1.0-SNAPSHOT
[ERROR]   +-com.google.apis:google-api-services-youtube:jar:v3-rev20250224-2.0.0:compile
[ERROR]     +-com.google.api-client:google-api-client:jar:2.7.2:compile
[ERROR]       +-com.google.http-client:google-http-client:jar:1.45.2:compile

Aside from the rule violation - dependency conflicts should be avoided wherever possible.

Describe the solution you'd like

Streamlined dependency-management. My personal perference would be a bom maven dependency that manages all direct and transitive dependencies of google-api-java-client-services

Describe alternatives you've considered

Using various (and complicated) exclusions in maven. While this is doable, it seems brittle and hard to maintain. As a user of google-api-services-youtube it's hard to know which versions work well together.

Additional context

I've created a Github-project that reproduces the problem: https://github.com/jjank/yt-api-dependency-conflicts

[diegomarquezp]

Hi @jjank, thanks for pointing this out.

We do have a README explaining how to set up the usage of this library with our BOM. However I see the readme in the source code repository may not be as prominent as the official docs, which don't mention the BOM (they should). Would you mind explaining what documentation you followed?

If the enforcer still gives problems after including the BOM, would you mind a pom.xml for further inspection?

[diegomarquezp]

We should update the installation section of https://developers.google.com/api-client-library/java

[jjank]

Hi @diegomarquezp,

thanks for the pointers and sorry for the late reply.

Would you mind explaining what documentation you followed?

Quite honestly - I simply googled "google-api-services-youtube" which lead me straight to it's README. The project was set up many years ago - it's quite possible that the BOM did not exist yet at that point in time.

I tried using the BOM dependency management. A few observations here:

• It's not obvious what the correct version should be. In my particular case I "just" want to consume google-api-services-youtube:v3-rev20250224-2.0.0 - but what is the correct version of google-api-client-bom ? I suppose it's 2.7.2 but that requires inspecting the pom of google-api-services-youtube
• Even after including the bom and explicitly declaring the managed dependency on google-api-client (see jjank/yt-api-dependency-conflicts@49a6882) the dependency conflicts remain the same. Looking at the output of the enforcer analysis the problem seems to be that both google-oauth-client and google-auth-library-oauth2-http each include a different version of google-http-client

If the enforcer still gives problems after including the BOM, would you mind a pom.xml for further inspection?

Sure: https://github.com/jjank/yt-api-dependency-conflicts/blob/master/pom.xml

[jjank]

Gentle ping @diegomarquezp 🙃

[diegomarquezp]

Hi @jjank. Looks like this dependency divergence is not unique to the youtube client. We will confirm and provide a fix if so.