verizon/sbt-blockade

Warn or ban particular dependencies in a build to prevent usage.

sbt-blockade's Issues

Cross-publish for sbt-1.0

sbt-blockade does not work with sbt-coursier (for transitive dependency violations?)

It seems, at least from my experiments, that sbt-blockade does not play nice with sbt-coursier for transitive dependency violations. It seems to work fine for direct dependencies. Here is my reproduction:

build.sbt

scalaVersion := "2.12.1"

blockadeUris := Seq(new java.net.URI(s"file:///${baseDirectory.in(ThisBuild).value}/blockade.json"))

compile in Compile := { blockade.value; (compile in Compile).value }

libraryDependencies += "co.fs2" %% "fs2-io" % "0.9.6"

blockade.json

{
  "blacklist": [
    {
      "organization": "co.fs2",
      "name": "fs2-core",
      "range": "(,0.9.6]",
      "expiry": "2017-09-21 00:00:00"
    }
  ]
}

project/plugins.sbt

addSbtPlugin("io.verizon.build"  % "sbt-blockade" % "0.2.35")
// addSbtPlugin("io.get-coursier" % "sbt-coursier" % "1.0.0-RC3")

project/build.properties

sbt.version=0.13.15

Running blockade warns as expected. Un-commenting the sbt-coursier plugin and running again says it succeeds.

If the fs2-io dependency is changed to fs2-core then it seems to succeed with or without Coursier 🤷‍♂️