Develop Reference

Trying to exclude transitive Log4j dependency

So I've seen other posts (eg. Can't use hbase-shaded-client jar because of its internal dependency to log4j-1.2.17(CVE-2019-1757)) stating that they have a way to exclude the transitive dependency of log4j:log4j:1.2.17 however if I run ./gradlew app:dependencies I can still see that the transitive dependency exists.
I have tried referring to the following migration doc https://logging.apache.org/log4j/2.x/manual/migration.html but Im not sure if this is just transferring the calls over from log4j 1.x over to 2.x at runtime or if its supposed to update the transitive dependency all together. I tried even excluding the transitive dependency and using slf4j instead in my build.gradle file like so:
compile ('custom-library-that-I-cant-change-code-in'), {
exclude group: 'log4j', module: 'log4j'
}
// https://mvnrepository.com/artifact/org.slf4j/log4j-over-slf4j
implementation 'org.slf4j:log4j-over-slf4j:1.7.35'
How can I make sure if this is even working, or at least not using that older log4j:log4j:1.2.17 or am I going about this all wrong and there is an easier way of doing this

To answer you first question the following exclude wasn't working for me as well,
compile ('custom-library-that-I-cant-change-code-in'), {
exclude group: 'log4j', module: 'log4j'
}
try this in your build.gradle it should work
configurations {
compile.exclude group: "log4j", module: "log4j"
}

How to exlude a jar file from an Android dependency?

I've read and tried a lot of post solution for this problem but there is something I am doing wrong because it is not working for me.
I have just updated Android to AndroidX which came with the dependency androidx.preference:preference:1.1.0-alpha04. This dependency included the jar file named com.google.guava:listenablefuture:1.0#jar. The problem is that com.google.common.util.concurrent.ListenableFuture is found twice in the dependencies and this gives me an error when I build the project. I also found that the whole jar file (androidx.preference:preference:1.1.0-alpha04) can be removed as the file that is in there is already in another dependency library.
I have tried to add some notations to exclude the library but none of them worked out unfortunatelly. The jar file keeps being added once I build the project.
build.gradle
dependencies {
implementation fileTree(dir: 'libs', include: ['*.jar'])
implementation('org.ros.android_core:android_10:[0.3, 0.4)') {
exclude group: 'junit'
exclude group: 'xml-apis'
}
// e.g. official msgs
implementation 'org.ros.rosjava_messages:std_msgs:0.5.11'
implementation 'org.ros.rosjava_messages:sensor_msgs:1.12.7'
implementation 'org.ros.rosjava_messages:geometry_msgs:1.12.7'
implementation 'org.ros.rosjava_bootstrap:message_generation:0.3.3'
implementation 'com.android.support.constraint:constraint-layout:2.0.0-alpha5'
implementation ("androidx.preference:preference:1.1.0-alpha04", {
exclude group: 'com.google.guava'
})
implementation 'com.google.code.gson:gson:2.8.5'
implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:$kotlin_version"
testImplementation 'junit:junit:4.12'
testImplementation 'org.mockito:mockito-core:2.27.0'
androidTestImplementation 'com.android.support.test:runner:1.0.2'
androidTestImplementation 'com.android.support.test.espresso:espresso-core:3.0.2'
}
repositories {
mavenCentral()
}
The dependency that can be excluded:
What am I doing wrong or how should I actually exclude the jar file from the dependency?
EDIT: The reason I want to do this is because I get the following error:
Duplicate class com.google.common.util.concurrent.ListenableFuture found in modules guava-12.0.jar (com.google.guava:guava:12.0) and listenablefuture-1.0.jar (com.google.guava:listenablefuture:1.0)

I think this should work:
implementation ("androidx.preference:preference:1.1.0-alpha04", {
exclude group: 'com.google.guava'
})
EDIT
This answer probably should help you:
https://stackoverflow.com/a/54717425/7947225
Add in your gradle.properties:
android.useAndroidX=true
android.enableJetifier=true
In your build.gradle, add
configurations {
all*.exclude group: 'com.google.guava', module: 'listenablefuture'
}
Then Clean and finally Build the project.

gradle exclude specific jars from runtime dependencies

Is there a way to exclude specific jars from a group using Gradle? I have tried below code, but this removed all the jars of that group
configurations {
all*.exclude group: 'org.xxxx.xxxx'
}
My requirement is to remove only specific jars from the group, not all jars. This exercise we are doing to exclude transitive dependencies during runtime in our system.
thanks.

You can exclude all dependencies from a group, or only some modules of a group, in dependencies block:
dependencies {
/* -------------- SpringBoot without Tomcat ------------------- */
compile('org.springframework.boot:spring-boot-starter-web') {
exclude group: 'org.springframework.boot', module: 'spring-boot-starter-tomcat'
}
}
I add link to the Gradle documentation explaining transitive dependencies in detail: https://docs.gradle.org/current/userguide/managing_transitive_dependencies.html

Compile dependencies dynamically based on spring.profiles.active

Can someone please guide me where to start this task?
I'd simply have to exclude spring-boot-starter-tomcat when deploying to jboss.
I imagine it will look something like:
dependencies {
compile("org.springframework.boot:spring-boot-starter-web"){
if(getProperty "spring.profiles.active" == "qat")
exclude module: "spring-boot-starter-tomcat"
}
testCompile('org.springframework.boot:spring-boot-starter-test')
}
With the sample above, I get an error:
Could not get unknown property 'spring.profiles.active' for DefaultExternalModuleDependency{group='org.springframework.boot', name='spring-boot-starter-web', version='null', configuration='default'} of type org.gradle.api.internal.artifacts.dependencies.DefaultExternalModuleDependency.
Maybe I could create a custom task to set spring.profiles.active on the task. HELP!

As Peter Ledbrook mentioned, gradle does not have access to spring-boot's application.yml at compile time. And the dependencies run very early in gradle's lifecycle that a task is never called before dependencies are resolved.
Even trying dependency resolution strategy was futile.
So I just had to do:
dependencies {
compile("org.springframework.boot:spring-boot-starter-web") {
if(System.getProperty("spring.profiles.active") == "qat"){
exclude module: "spring-boot-starter-tomcat"
}
}
compile("org.springframework.boot:spring-boot-starter-security")
if(System.getProperty("spring.profiles.active") == "qat"){
providedCompile group: 'javax.servlet', name: 'javax.servlet-api', version: '3.0.1'
}
testCompile('org.springframework.boot:spring-boot-starter-test')
}
Then I'll type gradle build -Dspring-profiles-active=qat when deploying to jboss. and gradle bootRun -Dspring-profiles-active=dev when I have to run locally.

Android gradle build with firebase dependency has warnings (ignoring httpclient)

In my Android project which use firebase the gradle build shows this annoying warning:
WARNING: Dependency org.apache.httpcomponents:httpclient:4.0.1 is ignored for devDebug as it may be conflicting with the internal version provided by Android.
In case of problem, please repackage it with jarjar to change the class packages
i tryed adding the exclude option on the build.gradle but i had no luck
compile ('com.firebase:firebase-client-android:2.2.1') {
exclude module: 'org.apache.httpcomponents:httpclient:4.0.1' //IGNORED
}
i also tryed removing the version like suggested but the warning remains
compile ('com.firebase:firebase-client-android:2.2.1') {
exclude group:'org.apache.httpcomponents', module: 'httpclient' //SAME
}

I found the option to remove the warning
configurations {
compile.exclude group: "org.apache.httpcomponents", module: "httpclient"
}

If I am not mistaken this should be
compile ('com.firebase:firebase-client-android:2.2.1') {
exclude group:'org.apache.httpcomponents', module: 'httpclient'
}
version can be omitted.