Strange versions conflict in sbt strict mode

Question

Why sbt (1.3.5) fail to resolve identical dependencies in strict mode?

> cat build.sbt
conflictManager := sbt.ConflictManager.strict
libraryDependencies += "io.grpc" % "grpc-all" % "1.26.0"

sbt:test> compile
[error] stack trace is suppressed; run last update for the full output
[error] (update) lmcoursier.internal.shaded.coursier.error.conflict.StrictRule: Rule Strict(Set(ModuleMatcher(*:*)),Set(),false,true,false) not satisfied: lmcoursier.internal.shaded.coursier.params.rule.Strict$EvictedDependencies: Unsatisfied rule Strict(*:*): Found evicted dependencies:
[error] 
[error] io.grpc:grpc-api:1.26.0 ([1.26.0] wanted)
[error] └─ io.grpc:grpc-all:1.26.0
[error] 
[error] io.grpc:grpc-api:1.26.0 ([1.26.0] wanted)
[error] └─ io.grpc:grpc-auth:1.26.0
[error]    └─ io.grpc:grpc-all:1.26.0
[error] 
[error] io.grpc:grpc-api:1.26.0 ([1.26.0] wanted)
[error] └─ io.grpc:grpc-core:1.26.0
[error]    ├─ io.grpc:grpc-all:1.26.0
[error]    ├─ io.grpc:grpc-netty:1.26.0
[error]    │  └─ io.grpc:grpc-all:1.26.0
[error]    ├─ io.grpc:grpc-okhttp:1.26.0
[error]    │  └─ io.grpc:grpc-all:1.26.0
[error]    └─ io.grpc:grpc-testing:1.26.0
[error]       └─ io.grpc:grpc-all:1.26.0
[error] 
[error] io.netty:netty-codec-http2:4.1.42.Final ([4.1.42.Final] wanted)
[error] └─ io.grpc:grpc-netty:1.26.0
[error]    └─ io.grpc:grpc-all:1.26.0
[error] 
[error] io.grpc:grpc-core:1.26.0 ([1.26.0] wanted)
[error] └─ io.grpc:grpc-all:1.26.0
[error] 
[error] io.grpc:grpc-core:1.26.0 ([1.26.0] wanted)
[error] └─ io.grpc:grpc-netty:1.26.0
[error]    └─ io.grpc:grpc-all:1.26.0
[error] 
[error] io.grpc:grpc-core:1.26.0 ([1.26.0] wanted)
[error] └─ io.grpc:grpc-okhttp:1.26.0
[error]    └─ io.grpc:grpc-all:1.26.0
[error] 
[error] io.grpc:grpc-core:1.26.0 ([1.26.0] wanted)
[error] └─ io.grpc:grpc-testing:1.26.0
[error]    └─ io.grpc:grpc-all:1.26.0
[error] Total time: 0 s, completed 19.12.2019 13:38:43

Expected and actual versions are the same. However, explicit version override works, but it's annoying to resolve all transitive dependencies.

Is it sbt or coursier bug?

Answer 1

Is it sbt or coursier bug?

I am not 100% sure, but I'd think this is something that would require a fix in Coursier.

An interesting thing about grpc that might not be obvious at the first glance is that it is declaring its dependencies using version range [1.26.0] as opposed to just saying 1.26.0. This can be confirmed by looking at their POM file.

Coursier (or shaded lm-coursier with relaxedForAllModules set as Reconciliation strategy to be specific) seems to be resolving for example grpc-api correctly to 1.26.0, but take a look at show updateFull:

...
[info]  io.grpc:grpc-api
[info]      - 1.26.0
[info]          evicted: false
[info]          homepage: https://github.com/grpc/grpc-java
[info]          configurations: test, optional, compile, default, runtime
[info]          callers: io.grpc:grpc-protobuf-lite:1.26.0, io.grpc:grpc-protobuf:1.26.0, io.grpc:grpc-stub:1.26.0, io.grpc:grpc-all:1.26.0, io.grpc:grpc-core:1.26.0, io.grpc:grpc-auth:1.26.0
[info]      - [1.26.0]
[info]          evicted: true
[info]          evictedData: version selection
[info]          homepage: https://github.com/grpc/grpc-java
[info]          configurations: test, optional, compile, default, runtime
[info]          callers: io.grpc:grpc-all:1.26.0
[info]      - [1.26.0]
[info]          evicted: true
[info]          evictedData: version selection
[info]          homepage: https://github.com/grpc/grpc-java
[info]          configurations: test, optional, compile, default, runtime
[info]          callers: io.grpc:grpc-auth:1.26.0
[info]      - [1.26.0]
[info]          evicted: true
[info]          evictedData: version selection
[info]          homepage: https://github.com/grpc/grpc-java
[info]          configurations: test, optional, compile, default, runtime
[info]          callers: io.grpc:grpc-core:1.26.0
...

It is incorrectly reporting [1.26.0] as a version that was evicted by 1.26.0. It's also including the same stuff three times with different caller.

Since sbt generates eviction report based on the update report, if this is fixed, I think the eviction report would be fixed on its own.