then why do I still see it, if the lib includes the gson via `implementation` anyways?

# gradle

[ursus]

then why do I still see it, if the lib includes the gson via implementation anyways?

[octylFractal]

implementation only affects consumers of your program, not of the library mentioned in the declaration

[octylFractal]

i.e. if someone depended on your code, they would not see the 3rd party lib or GSON

[octylFractal]

it does not control if the 3rd party lib leaks its transitive dependencies to your compile classpath, which it clearly does. there's not much you can do to fix this besides asking them to properly separate their transitive dependencies (I don't recommend blindling excluding transitive dependencies since they won't end up on your runtime classpath without careful handling)

[ursus]

okay so youre saying A > B > C, if B includes implementation of C, then A wont see C right?

[octylFractal]

yes, if B had implementation(C), A would not see C

[octylFractal]

but if B is e.g. a maven project and declares a normal dependency on C, then A having implementation(B) would still allow it to see C

[ursus]

okay, but this still doesnt explain it why does B sees Gson if its B > C > Gson

[ursus]

if C.implementation(Gson)

[ursus]

(C is the 3rd party lib)

[octylFractal]

are you sure that C has implementation(Gson)?

[ursus]

https://github.com/exponea/exponea-android-sdk/blob/develop/sdk/build.gradle#L51

it does, right? I dont trust anything anymore

[ursus]

and in my build.gradle ,

implementation "com.exponea.sdk:sdk:2.4.0"}

[octylFractal]

hmm, I'm not sure why, but the real source of truth is the pom.xml: https://repo1.maven.org/maven2/com/exponea/sdk/sdk/2.7.2/sdk-2.7.2.pom

which clearly states that everything is in the compile scope, not the runtime scope, meaning it will be included on your compile classpath

[octylFractal]

typically using implementation will result in the published pom.xml having a scope of runtime for those dependencies, but maybe that only happens if the java-library plugin is applied to the project

[ursus]

okay, so, if I implementation exponea, when I should only see exponea own code, not its dependencies, right?

[ursus]

(if all went well, just to clarify)

[octylFractal]

pretty much, since it declares no api dependencies -- if it did you would see those

[ursus]

okay so atleast I understood it correctly all along. Im going to open up a ticket with them, thank you!