Turns out one of the transitive dependencies used ...
# kobalt
c
Turns out one of the transitive dependencies used a range (basically "the latest version available") and somebody had created a bogus 999 version of that library on JCenter, which broke the build