Blocker (regression in 6.1.2): "Unable to find method 'com.google.common.collect.ImmutableList.toImmutableList()Ljava/util/stream/Collector;'"

[alwa]

Describe the bug
Cannot evaluate Gradle project. My project uses Android Gradle Plugin version 4.1.2, Gradle version 6.8.3 and Jdk version 11.

Version of dependency-check used
The problem occurs using version 6.1.2 (and 6.1.3) of the gradle plugin. It works fine in 6.1.1 and below.

Log file

Unable to find method 'com.google.common.collect.ImmutableList.toImmutableList()Ljava/util/stream/Collector;'
com.google.common.collect.ImmutableList.toImmutableList()Ljava/util/stream/Collector;

[jeremylong]

Looks like a dependency conflict in your build environment. No where in ODC is toImmutableList() called: https://github.com/jeremylong/DependencyCheck/search?q=toImmutableList

Pretty sure ODC can use Guava [24.1.1,]

[alwa]

Ok thanks. I will investigate on my side.

[jeremylong]

In ODC 6.1.4 - I explicitly set the version of Guava to be 24.1.1-jre as opposed to using a version range.

[alwa]

I've looked through the gradle dependencies and I don't have any clear conclusion.
I have a transitive dependency to Guava (different version) through a test library called Robolectric but there is apparantly also a (unspecified) direct dependency :

releaseUnitTestCompileClasspath - Resolved configuration for compilation for variant: releaseUnitTest
...
+--- com.google.guava:guava:{strictly 27.0.1-jre} -> 27.0.1-jre (c)

Related:
https://stackoverflow.com/questions/54635950/android-x-truth-guava-test-compile-issue
google/error-prone#528
google/dagger#1700

I have not tried any of the workarounds like adding a direct dependency in my project. It feels like a hack to do so.

[alwa]

I've attached the output from my projects dependencies. Note: This is performed using version 6.1.1 of the ODC.

dependency-tree.txt

[alwa]

I've created a new sample Android project (using the tutorial in Android Studio) and can reproduce the issue easily without adding more code than the reference to the ODC in the plugin section (build.gradle):

MyApplication.zip

To reproduce the issue:

1. Download Android Studio 4.1.3, https://developer.android.com/studio
2. In Android Studio:

• Import attached sample project "MyApplication"
• Choose from dropdown menu: File -> Sync Project with Gradle Files

Expected:
Project resolved OK

Actual:
Error:

Unable to find method 'com.google.common.collect.ImmutableList.toImmutableList()Ljava/util/stream/Collector;'
com.google.common.collect.ImmutableList.toImmutableList()Ljava/util/stream/Collector;

[jeremylong]

@alwa One solution is to strictly enforce the use of Guava 28.1-jre:

buildscript {
    repositories {
        google()
        jcenter()
    }
    dependencies {
        classpath('com.google.guava:guava'){
            version {
                strictly '28.1-jre'
            }
        }
        classpath "com.android.tools.build:gradle:4.1.3"
        classpath("org.owasp:dependency-check-gradle:6.1.3") 
    }
}

[alwa]

@jeremylong this ticket looks like a duplicate of dependency-check/dependency-check-gradle#213
I'll proceed and close this one if you agree.

As for the provided workaround I don't think it's very appealing to leak dependency information but I guess you had your reasons to enforce strictness on Guava and that there is no way to prevent this from leaking?

[jeremylong]

I just bumped guava to 30.1.1-jre via f861019 and retested with your sample project and everything works.