Restore Dependency Constraints for commons-codec and commons-logging #8836
Description
Recently, the build began to fail with:
* What went wrong:
Execution failed for task ':spring-security-web:compileTestJava'.
> Could not resolve all files for configuration ':spring-security-web:testCompileClasspath'.
> Could not find commons-codec:commons-codec:1.15-SNAPSHOT.
Required by:
project :spring-security-web
> Could not find commons-codec:commons-codec:1.15-SNAPSHOT.
Required by:
project :spring-security-web
project :spring-security-web > project :spring-security-core
project :spring-security-web > project :spring-security-core > project :spring-security-crypto
When run with --debug, the build complains that it cannot find the appropriate POM for the snapshot version:
2020-07-15T20:04:09.617-0600 [DEBUG] [org.apache.http.impl.execchain.MainClientExec] Executing request GET /libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/maven-metadata.xml HTTP/1.1
2020-07-15T20:04:09.727-0600 [INFO] [org.gradle.internal.resource.transport.http.HttpClientHelper] Resource missing. [HTTP GET: https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/maven-metadata.xml]
2020-07-15T20:04:09.727-0600 [DEBUG] [org.gradle.internal.operations.DefaultBuildOperationExecutor] Completing Build operation 'Download https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/maven-metadata.xml'
2020-07-15T20:04:09.727-0600 [DEBUG] [org.gradle.internal.operations.DefaultBuildOperationExecutor] Build operation 'Download https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/maven-metadata.xml' completed
2020-07-15T20:04:09.728-0600 [DEBUG] [org.gradle.api.internal.artifacts.repositories.resolver.DefaultExternalResourceArtifactResolver] Loading https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/commons-codec-1.15-SNAPSHOT.pom
2020-07-15T20:04:09.728-0600 [DEBUG] [org.gradle.internal.resource.transfer.DefaultCacheAwareExternalResourceAccessor] Constructing external resource: https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/commons-codec-1.15-SNAPSHOT.pom
2020-07-15T20:04:09.728-0600 [DEBUG] [org.gradle.internal.operations.DefaultBuildOperationExecutor] Build operation 'Download https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/commons-codec-1.15-SNAPSHOT.pom' started
2020-07-15T20:04:09.729-0600 [DEBUG] [org.gradle.internal.resource.transport.http.HttpResourceAccessor] Constructing external resource: https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/commons-codec-1.15-SNAPSHOT.pom
2020-07-15T20:04:09.729-0600 [DEBUG] [org.gradle.internal.resource.transport.http.HttpClientHelper] Performing HTTP GET: https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/commons-codec-1.15-SNAPSHOT.pom
2020-07-15T20:04:09.730-0600 [DEBUG] [org.apache.http.impl.execchain.MainClientExec] Executing request GET /libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/commons-codec-1.15-SNAPSHOT.pom HTTP/1.1
2020-07-15T20:04:09.828-0600 [INFO] [org.gradle.internal.resource.transport.http.HttpClientHelper] Resource missing. [HTTP GET: https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/commons-codec-1.15-SNAPSHOT.pom]
2020-07-15T20:04:09.828-0600 [DEBUG] [org.gradle.internal.operations.DefaultBuildOperationExecutor] Completing Build operation 'Download https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/commons-codec-1.15-SNAPSHOT.pom'
2020-07-15T20:04:09.828-0600 [DEBUG] [org.gradle.internal.operations.DefaultBuildOperationExecutor] Build operation 'Download https://repo.spring.io/libs-snapshot/commons-codec/commons-codec/1.15-SNAPSHOT/commons-codec-1.15-SNAPSHOT.pom' completed
2020-07-15T20:04:09.828-0600 [DEBUG] [org.gradle.api.internal.artifacts.repositories.resolver.ExternalResourceResolver] No meta-data file or artifact found for module 'commons-codec:commons-codec:1.15-SNAPSHOT' in repository 'maven'.
It's not clear to me whether it's important for the build to be based on the snapshot builds of third-party libraries.
On the other hand, it's a surprise to me that this is an issue as it's certainly reasonable for Gradle to be able to resolve the timestamped POM of a SNAPSHOT version.