The dependencie 'com.squareup.okhttp3:okhttp-bom:4.10.0' is crashing

[MauricioMej]

Description

I'm trying to implement the SDK in react native CLI, but when is building, the dependencie okhttp3 crash the build.

implementation 'com.squareup.okhttp3:okhttp-bom:4.10.0'

Reproduction of issue

I import the SDK into react native

Sample:

• Code sample:
• • I create a simple react native project

npx react-native init Example

And i import the Guardian SDK

• Log files:

* What went wrong:
Could not determine the dependencies of task ':app:processDebugResources'.
> Could not resolve all task dependencies for configuration ':app:debugRuntimeClasspath'.
   > Could not resolve com.squareup.okhttp3:okhttp-bom:4.10.0.
     Required by:
         project :app > com.auth0.android:guardian:0.8.0
      > No matching variant of com.squareup.okhttp3:okhttp-bom:4.10.0 was found. The consumer was configured to find a library for use during runtime, preferably optimized for Android, as well as attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'debug', attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '8.2.1', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm' but:
          - Variant 'apiElements' capability com.squareup.okhttp3:okhttp-bom:4.10.0:
              - Incompatible because this component declares a platform for use during compile-time and the consumer needed a library for use during runtime        
              - Other compatible attributes:
                  - Doesn't say anything about com.android.build.api.attributes.AgpVersionAttr (required '8.2.1')
                  - Doesn't say anything about com.android.build.api.attributes.BuildTypeAttr (required 'debug')
                  - Doesn't say anything about its target Java environment (preferred optimized for Android)
                  - Doesn't say anything about org.jetbrains.kotlin.platform.type (required 'androidJvm')
          - Variant 'enforcedApiElements' capability com.squareup.okhttp3:okhttp-bom-derived-enforced-platform:4.10.0:
              - Incompatible because this component declares an enforced platform for use during compile-time and the consumer needed a library for use during runtime
              - Other compatible attributes:
                  - Doesn't say anything about com.android.build.api.attributes.AgpVersionAttr (required '8.2.1')
                  - Doesn't say anything about com.android.build.api.attributes.BuildTypeAttr (required 'debug')
                  - Doesn't say anything about its target Java environment (preferred optimized for Android)
                  - Doesn't say anything about org.jetbrains.kotlin.platform.type (required 'androidJvm')
          - Variant 'enforcedRuntimeElements' capability com.squareup.okhttp3:okhttp-bom-derived-enforced-platform:4.10.0 declares a component for use during runtime:
              - Incompatible because this component declares an enforced platform and the consumer needed a library
              - Other compatible attributes:
                  - Doesn't say anything about com.android.build.api.attributes.AgpVersionAttr (required '8.2.1')
                  - Doesn't say anything about com.android.build.api.attributes.BuildTypeAttr (required 'debug')
                  - Doesn't say anything about its target Java environment (preferred optimized for Android)
                  - Doesn't say anything about org.jetbrains.kotlin.platform.type (required 'androidJvm')
          - Variant 'runtimeElements' capability com.squareup.okhttp3:okhttp-bom:4.10.0 declares a component for use during runtime:
              - Incompatible because this component declares a platform and the consumer needed a library
              - Other compatible attributes:
                  - Doesn't say anything about com.android.build.api.attributes.AgpVersionAttr (required '8.2.1')
                  - Doesn't say anything about com.android.build.api.attributes.BuildTypeAttr (required 'debug')
                  - Doesn't say anything about its target Java environment (preferred optimized for Android)
                  - Doesn't say anything about org.jetbrains.kotlin.platform.type (required 'androidJvm')

• Application settings:

build.gradle

dependencies {
      implementation("com.facebook.react:react-android")
      implementation 'com.auth0.android:guardian:0.8.0'

      if (hermesEnabled.toBoolean()) {
          implementation("com.facebook.react:hermes-android")
      } else {
          implementation jscFlavor
      }
  }

Environment

Please provide the following:

• Version of this library used: Guardian 0.8.0
• Version of the platform or framework used, if applicable: React Native 0.74.1

[andy317fe301f8c7]

Hello,
This may be an issue with your gradle configuration. I suggest either attempting to declare the dependency in your build.gradle and to ensure that your project has mavenCentral properly configured as a repository

[LukaszK88]

@MauricioMej did you manage to resolve it?

[MauricioMej]

Not yet, I tried to import the dependency separately, but it still gives me an error.

[LukaszK88]

version com.auth0.android:guardian:0.6.0 seems to work without this issue.

[Bazni]

I have the same problem as @MauricioMej, I may have found a solution but it would need to add a new dependency.

The bug has been present since version 0.7 of this package when okhttp-bom:4.10 has been added.

Is it possible to add implementation(platform("com.squareup.okhttp3:okhttp-bom:4.12.0")) in the dependencies. 4.12 is the latest but I supposed 4.10 should be good

[shaoyangdl]

I have the same problem as @MauricioMej, I may have found a solution but it would need to add a new dependency.

The bug has been present since version 0.7 of this package when okhttp-bom:4.10 has been added.

Is it possible to add implementation(platform("com.squareup.okhttp3:okhttp-bom:4.12.0")) in the dependencies. 4.12 is the latest but I supposed 4.10 should be good

I tried to add the dependency to every single module that using auth0, but still gets the issue

[Bazni]

Did you try to fork this package and replace implementation("com.squareup.okhttp3:okhttp-bom:4.10.0") by what I suggest?
It's not working on my side either but it's the only thing I have in mind that could fix the issue.

Did you try to run your project with the same Gradle version as this package?

[rontho]

That issue prevent from using the sdk since version 7. There is an open PR to fix this, is it possible to get it merged and released please? Thank you

[alex-crookes]

Is there any further update on this? I am working on an Android native project where our Security vendor is requiring us to implement Okta as well as Guardian SDK. I also have a bug whereby I am unable to Accept/Reject Push Notifications from the Guardian SDK with a 401 unauthorized response.

I am being told the solution to this is to update to a later version of Guardian SDK (I am currently on 0.6.0). However, when I try , Gradle throws an error as com.squareup.okhttp3:okhttp-bom:4.10.0. This happens with any version 0.7.0 or greater.

I see there is a PR open (#118) - Is there are status update on? Or is there another work around?

[alex-crookes]

For anyone still struggling with this, I think I both understand the problem and have a client fix for you.

I ran into the same problem recently in a project that used Version Catalog/TOML to manage dependencies, especially when you have other versions of OKHttp in use (we are using 5.x in the app and AS Gradle Plugin 8.9.1)

If this is you, read on...

In TOML, you define your DEP as

auth0-guardian = { module = "com.auth0.android:guardian", version.ref = "guardian" }

So you can import this in your projects as

implementation libs.auth0.guardian

When you do this, it appears the dependencies in the Guardian SDK resolve to the App (i.e. 5.x) and not those of the BOM. Also, it appears the BOM fails to resolve.

Normally, you fix this in your build.gradle with

Implementation libs.auth0.guardian {
    exclude group: "com.squareup.okhttp3", module: "okhttp-bom"
}

However, this doesn't work in TOML - at this point, the dependency is resolved and you cannot override it.

The solution is to remove the dependency from TOML and declare it only in build.gradle as

implementation("com.auth0.android:guardian:0.10.1") {
    exclude group: "com.squareup.okhttp3", module: "okhttp-bom"
}

It's not perfect, but it does work for me...