Consider rollbacking RSocket BOM dependency

[celcius112]

Hello everyone,

We tried updating our applications to Spring Boot 2.2.5 (we are using gradle 6.2), and we are receiving this exception when resolving the dependencies org.gradle.internal.resolve.ModuleVersionResolveException: Could not resolve io.rsocket:rsocket-bom:1.0.0-RC6, even though we do not use RSocket. It seems like RSocket does not publish a Gradle module metadata hence the error.

One of my colleague opened an issue on the RSocket repo.

Overriding the dependency or the version does not solve the issue.

Until the issue is fixed on RSocket side, I'm wondering whether we should rollback to RC5.

[celcius112]

For information this problem will arise when enabling the consumption of Gradle module metadata, which is the default in Gradle 6, so rollbacking to version 5.6 or disabling this feature would resolve the issue. But this is only a workaround and not a real solution

[snicoll]

@celcius112 before we consider doing anything, I'd like to understand the issue a bit more. Creating a project on start.spring.io with Gradle and 2.2.5 does not yield to that issue. I've tried with Gradle 6.0.1 and 6.2.1.

If you can share a small sample that reproduces the problem, that would be idea. If you are using the dependency management plugin, make sure first you're using 1.0.9.RELEASE as we've recently fixed an issue in that area.

[celcius112]

Thank you @snicoll, you're right I should have reproduced with a smaller spring boot project 😅.

So after some investigation RSocket is indeed not packaged with a Gradle module metadata although its pom declares it otherwise.
The main difference in my case is the way maven central and my project's repository handle missing files. While the first will return a 404 (when GETting https://repo.maven.apache.org/maven2/io/rsocket/rsocket-bom/1.0.0-RC6/rsocket-bom-1.0.0-RC6.module), the latter will instead return a 403. Gradle probably handles 404 but not 403.

Since the mistake is definitely on RSocket side, and the behavior comes from Gradle's error handling, I guess this issue might be closed. Sorry for disturbing 😁

[celcius112]

For future reference: gradle/gradle#5606

[wilkinsona]

Thanks for letting us know.