升级Gradle 8.13时无法找到传递依赖的问题求助

我正在将SpringBoot项目从Gradle 5.6升级至8.13，构建时遇到问题：内部生成的JAR（从Artifactory拉取）依赖的两个传递依赖包castor-commons和object-explorer找不到。我已经确认这两个JAR存在于Artifactory中，但不知道问题出在哪，求建议。

Gradle终端错误信息 #

Execution failed for task ':compileJava'.
> Could not resolve all files for configuration ':compileClasspath'.
> Could not find org.castor:castor-commons:1.0.5.
Required by:
root project : > com.mydomain:mydomain-commons:2.0.10
> Could not find com.google:object-explorer:20140102.
Required by:
root project : > com.mydomain:mydomain-commons:2.0.10

Possible solution:
 - Declare repository providing the artifact, see the documentation at https://docs.gradle.org/current/userguide/declaring_repositories.html

gradle-wrapper.properties内容 #

distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.13-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists

build.gradle内容 #

plugins {
    id 'java'
    id 'org.springframework.boot' version '3.4.3'
    id 'io.spring.dependency-management' version '1.1.7'
}

group = 'com.mydomain'
version = '0.0.1-SNAPSHOT'

java {
    toolchain {
        languageVersion = JavaLanguageVersion.of(17)
    }
}

configurations {
    compileOnly {
        extendsFrom annotationProcessor
    }
}

repositories {
    mavenLocal()
    maven {
        name = "myReleaseRepo"
        url = "https://artifactory.mydomain.net/artifactory/libs-release"}
    maven {
        name = "mySnapshotRepo"
        url = "https://artifactory.mydomain.net/artifactory/libs-snapshot" }
    mavenCentral()
}

dependencies {
    implementation 'org.mydomain.ods.data:policy-ods-data-commons:1.3.2'
    implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'com.mydomain:mydomain-commons:2.0.10'
    implementation 'com.mydomain.commons:mydomain-commons-security:2.0.0'

    compileOnly 'org.projectlombok:lombok'

    annotationProcessor 'org.projectlombok:lombok'

    testImplementation 'org.springframework.boot:spring-boot-starter-test'
    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
}

tasks.named('test') {
    useJUnitPlatform()
}

控制台额外日志 #

2025-03-05T17:05:38.033-0600 [DEBUG] [org.gradle.api.internal.artifacts.ivyservice.ivyresolve.RepositoryChainComponentMetaDataResolver] Attempting to resolve component for org.castor:castor-commons:1.0.5 using repositories [MavenLocal, myReleaseRepo, mySnapshotRepo, MavenRepo]
2025-03-05T17:05:38.033-0600 [DEBUG] [org.gradle.api.internal.artifacts.ivyservice.ivyresolve.CachingModuleComponentRepository] Detected non-existence of module 'org.castor:castor-commons:1.0.5' in resolver cache 'MavenLocal'
2025-03-05T17:05:38.033-0600 [DEBUG] [org.gradle.api.internal.artifacts.ivyservice.ivyresolve.CachingModuleComponentRepository] Detected non-existence of module 'org.castor:castor-commons:1.0.5' in resolver cache 'myReleaseRepo'
2025-03-05T17:05:38.033-0600 [DEBUG] [org.gradle.api.internal.artifacts.ivyservice.ivyresolve.CachingModuleComponentRepository] Detected non-existence of module 'org.castor:castor-commons:1.0.5' in resolver cache 'mySnapshotRepo'
2025-03-05T17:05:38.033-0600 [DEBUG] [org.gradle.api.internal.artifacts.ivyservice.ivyresolve.CachingModuleComponentRepository] Detected non-existence of module 'org.castor:castor-commons:1.0.5' in resolver cache 'MavenRepo'

临时解决方法 #

我已经通过排除这两个依赖临时解决了问题，目前看这些依赖是遗留代码不需要，后续会做回归测试：

implementation ('com.mydomain:mydomain-commons:2.0.10') {
    exclude group: 'org.castor', module: 'castor-commons'
    exclude group: 'com.google', module: 'object-explorer'
}
implementation ('com.mydomain.commons:mydomain-commons-security:2.0.0') {
    exclude group: 'org.castor', module: 'castor-commons'
    exclude group: 'com.google', module: 'object-explorer'
}

核心原因分析及正式解决方法 #

可能的核心原因 #

1. Gradle依赖解析规则变更：从Gradle 5.x到8.x，依赖解析逻辑有不少更新，对Maven仓库的元数据处理更严格。如果Artifactory中这两个JAR的POM文件缺失或格式不符合Gradle 8.x要求，就会导致无法被识别。
2. 仓库权限或路径问题：虽然JAR存在，但Gradle访问Artifactory时可能没有权限读取对应的POM文件，或者JAR存放的路径不符合标准Maven布局（即groupId/artifactId/version的目录结构）。
3. 缓存问题：Gradle 8.x的缓存机制和5.x不同，旧缓存残留可能导致无法正确读取新仓库的元数据。
4. 依赖传递性规则变更：内部JAR的依赖声明在Gradle 5.x中被宽松处理，但8.x严格遵循传递依赖规则，比如某些依赖的范围标记不符合实际需求。

若需要保留依赖的解决方法 #

• 检查Artifactory中的POM文件：确认castor-commons:1.0.5和object-explorer:20140102对应的POM文件存在，且groupId、artifactId、version与Gradle报错的完全一致。
• 验证仓库权限与配置：确保Gradle使用的账号有权限访问这两个依赖所在的Artifactory仓库，若需要认证，需在仓库配置中添加credentials信息。
• 清理Gradle缓存：执行./gradlew clean build --refresh-dependencies强制刷新依赖缓存，避免旧缓存干扰。
• 添加显式依赖声明：如果传递依赖无法自动解析，直接在dependencies块中添加这两个依赖的显式声明：

  implementation 'org.castor:castor-commons:1.0.5'
  implementation 'com.google:object-explorer:20140102'
  

• 检查仓库布局：确认Artifactory中的仓库是标准Maven布局，依赖按groupId/artifactId/version的目录结构存放。

内容的提问来源于stack exchange，提问作者WishIWasJeeping