Fix dependency-locking config (#276)

* Fix dependency-locking config

Reenable dependency locking after a bug errorneouly turned it off.

Removed the guava-related workaround that forcefully resolve to
the -jre distribution.

Enabled locking for buildSrc by updating its property file.

Updated all lock files.

build.gradle

@@ -178,10 +178,21 @@ subprojects {
         resolutionStrategy.activateDependencyLocking()
       }
     }
-    // Lock application dependencies except for the gradle-license-report
-    // plugin. See dependency_lic.gradle for more information.
-    configurations.findAll { it.name != 'dependencyLicenseReport' }.each {
-      it.resolutionStrategy.activateDependencyLocking()
+  }
+
+  afterEvaluate {
+    if (rootProject.enableDependencyLocking.toBoolean()) {
+      // Lock application dependencies except for the gradle-license-report
+      // plugin. See dependency_lic.gradle for the reason why.
+      //
+      // To selectively activate dependency locking without hardcoding them
+      // in the 'configurations' block, the following code must run after
+      // project evaluation, when all configurations have been created.
+      configurations.each {
+        if (it.name != 'dependencyLicenseReport') {
+          it.resolutionStrategy.activateDependencyLocking()
+        }
+      }
     }
   }
 

buildSrc/gradle.properties

@@ -1 +1 @@
-enableDependencyLocking=false
+enableDependencyLocking=true

buildSrc/gradle/dependency-locks/buildscript-classpath.lockfile

@@ -15,12 +15,13 @@ com.googlecode.javaewah:JavaEWAH:1.1.6
 com.jcraft:jsch:0.1.54
 com.jcraft:jzlib:1.1.1
 com.netflix.nebula:gradle-lint-plugin:10.4.2
-com.netflix.nebula:nebula-gradle-interop:1.0.7
-com.netflix.nebula:nebula-test:7.2.5
+com.netflix.nebula:nebula-gradle-interop:1.0.11
+com.netflix.nebula:nebula-test:7.3.0
 commons-codec:commons-codec:1.9
 commons-io:commons-io:2.5
 commons-lang:commons-lang:2.6
 commons-logging:commons-logging:1.2
+javax.inject:javax.inject:1
 junit:junit:4.12
 log4j:log4j:1.2.14
 nebula.lint:nebula.lint.gradle.plugin:10.4.2
@@ -35,10 +36,10 @@ org.apache.ant:ant:1.8.4
 org.apache.commons:commons-lang3:3.8.1
 org.apache.httpcomponents:httpclient:4.5.2
 org.apache.httpcomponents:httpcore:4.4.4
-org.apache.maven:maven-artifact:3.6.1
-org.apache.maven:maven-builder-support:3.6.1
-org.apache.maven:maven-model-builder:3.6.1
-org.apache.maven:maven-model:3.6.1
+org.apache.maven:maven-artifact:3.6.2
+org.apache.maven:maven-builder-support:3.6.2
+org.apache.maven:maven-model-builder:3.6.2
+org.apache.maven:maven-model:3.6.2
 org.codehaus.gpars:gpars:1.2.1
 org.codehaus.groovy:groovy-all:2.4.9
 org.codehaus.groovy:groovy-ant:2.1.8
@@ -47,17 +48,18 @@ org.codehaus.groovy:groovy-templates:2.1.8
 org.codehaus.groovy:groovy-xml:2.4.7
 org.codehaus.groovy:groovy:2.4.7
 org.codehaus.jsr166-mirror:jsr166y:1.7.0
-org.codehaus.plexus:plexus-component-annotations:1.7.1
 org.codehaus.plexus:plexus-interpolation:1.25
-org.codehaus.plexus:plexus-utils:3.2.0
+org.codehaus.plexus:plexus-utils:3.2.1
 org.codenarc:CodeNarc:0.25.2
 org.eclipse.jdt:core:3.1.1
 org.eclipse.jgit:org.eclipse.jgit:5.0.1.201806211838-r
+org.eclipse.sisu:org.eclipse.sisu.inject:0.3.3
 org.gmetrics:GMetrics:0.7
 org.hamcrest:hamcrest-core:1.3
-org.jetbrains.kotlin:kotlin-stdlib-common:1.3.11
-org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.3.11
-org.jetbrains.kotlin:kotlin-stdlib:1.3.11
+org.jetbrains.kotlin:kotlin-stdlib-common:1.3.50
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.3.50
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.3.50
+org.jetbrains.kotlin:kotlin-stdlib:1.3.50
 org.jetbrains:annotations:13.0
 org.multiverse:multiverse-core:0.7.0
 org.objenesis:objenesis:2.4

buildSrc/gradle/dependency-locks/jacocoAgent.lockfile

@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.4

buildSrc/gradle/dependency-locks/jacocoAnt.lockfile

@@ -0,0 +1,11 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.4
+org.jacoco:org.jacoco.ant:0.8.4
+org.jacoco:org.jacoco.core:0.8.4
+org.jacoco:org.jacoco.report:0.8.4
+org.ow2.asm:asm-analysis:7.1
+org.ow2.asm:asm-commons:7.1
+org.ow2.asm:asm-tree:7.1
+org.ow2.asm:asm:7.1

core/gradle/dependency-locks/apt.lockfile

@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.

core/gradle/dependency-locks/archives.lockfile

@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.

core/gradle/dependency-locks/compile.lockfile

@@ -1,13 +1,15 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
 com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
 com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
@@ -108,9 +110,14 @@ com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -146,18 +153,23 @@ io.opencensus:opencensus-contrib-grpc-util:0.17.0
 io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
-javax.annotation:javax.annotation-api:1.2
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
-javax.xml.bind:jaxb-api:2.3.0
+javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.9.2
 junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.11.0
 org.apache.beam:beam-model-pipeline:2.11.0
@@ -169,7 +181,7 @@ org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
 org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
 org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.8.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
@@ -179,10 +191,22 @@ org.checkerframework:checker-qual:2.5.2
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
 org.joda:joda-money:0.10.0
 org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -192,7 +216,15 @@ org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
 org.ow2.asm:asm-util:6.0
 org.ow2.asm:asm:6.0
-org.slf4j:slf4j-api:1.7.25
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3

core/gradle/dependency-locks/compileClasspath.lockfile

@@ -1,13 +1,15 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+antlr:antlr:2.7.7
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
 com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml:classmate:1.3.4
 com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
@@ -107,9 +109,14 @@ com.googlecode.charts4j:charts4j:1.3
 com.googlecode.json-simple:json-simple:1.1.1
 com.ibm.icu:icu4j:57.1
 com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
 com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
 commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
@@ -144,18 +151,23 @@ io.opencensus:opencensus-contrib-grpc-util:0.17.0
 io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
-javax.annotation:javax.annotation-api:1.2
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.jdo:jdo2-api:2.3-eb
 javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
 javax.servlet:servlet-api:2.5
 javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
-javax.xml.bind:jaxb-api:2.3.0
+javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.9.2
 junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
 org.apache.beam:beam-model-job-management:2.11.0
 org.apache.beam:beam-model-pipeline:2.11.0
@@ -167,7 +179,7 @@ org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
 org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
 org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
-org.apache.commons:commons-compress:1.8.1
+org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
 org.apache.httpcomponents:httpcore:4.4.11
@@ -177,10 +189,22 @@ org.checkerframework:checker-qual:2.5.2
 org.codehaus.jackson:jackson-core-asl:1.9.13
 org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
 org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
 org.joda:joda-money:0.10.0
 org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
@@ -190,7 +214,15 @@ org.ow2.asm:asm-commons:6.0
 org.ow2.asm:asm-tree:6.0
 org.ow2.asm:asm-util:6.0
 org.ow2.asm:asm:6.0
-org.slf4j:slf4j-api:1.7.25
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
 org.threeten:threetenbp:1.3.3
 org.tukaani:xz:1.8
 org.w3c.css:sac:1.3

core/gradle/dependency-locks/compileOnly.lockfile

@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.