Pin Netty versions for maven_install? #8357
Description
For the normal Maven Central releases we have netty-codec-http2 version-pinned:
Line 171 in d836f38
However, currently for Bazel we do not:
Line 27 in d836f38
This feels like an oversight on my part, but it also might be appropriate given the difficulty in overriding the dependency. maven_install doesn't have a built-in way to exclude transitive deps from particular dependencies; it only has a way to exclude an (unversioned) dep from all dependencies. I think that means the main solution for a user needing to override the version pin would be to remove it from the artifacts list:
l = list(IO_GRPC_GRPC_JAVA_ARTIFACTS)
l.remove("io.netty:netty-codec-http2:[4.1.52.Final]")
maven_install(
artifacts = l,
generate_compat_repositories = True,
override_targets = IO_GRPC_GRPC_JAVA_OVERRIDE_TARGETS,
repositories = [
"https://repo.maven.apache.org/maven2/",
],
)That's not impossible for users, but is ugly. A macro would help though. It is nice that remove() fails the build if the entry is not present in the list and that the entry must include the version number.
That said, version pinning does nothing for Gradle users and we haven't seen many users reporting issues. That is probably strongly influenced by the heavy use of grpc-netty-shaded, but Bazel users don't see any shading and so would need to resolve any version conflict.