Stop including extra artifacts on maven.install()

[joca-bt]

As a user, I would expect maven.install() to not include any artifacts not specified by me. This doesn't seem to be the case, as there are several artifacts that will always be included under the default maven repository (@maven). This can result in artifact version conflicts which are surprising and difficult to debug, since users may not be able to reverse query the usage of these artifacts.

For example, let's create an empty Bazel project with the following MODULE.bazel:

module(name = "test")

bazel_dep(name = "rules_jvm_external", version = "6.1")
maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
maven.install()
use_repo(maven, "maven")

If we run

> bazel run @maven//:pin

we will get a maven_install.json with a few dozen artifacts (rules_jvm_external~~maven~maven_install.json). Instead, I would expect an almost empty file.

Looking inside the file, we see that it includes com.google.guava:guava:31.1-jre, amongst others. If the user declares their own Guava version

maven.install(
    artifacts = [
        "com.google.guava:guava:33.2.1-jre",
    ],
)

they will get a warning

DEBUG: /home/joao/.cache/bazel/_bazel_joao/f8a6fd52db31bf3b20511531b25631c2/external/rules_jvm_external~/private/extensions/maven.bzl:154:14: The maven repository 'maven' is used in two different bazel modules, originally in 'test' and now in 'protobuf'
DEBUG: /home/joao/.cache/bazel/_bazel_joao/f8a6fd52db31bf3b20511531b25631c2/external/rules_jvm_external~/private/extensions/maven.bzl:154:14: The maven repository 'maven' is used in two different bazel modules, originally in 'test' and now in 'protobuf'
DEBUG: /home/joao/.cache/bazel/_bazel_joao/f8a6fd52db31bf3b20511531b25631c2/external/rules_jvm_external~/coursier.bzl:743:18: Found duplicate artifact versions
    com.google.guava:guava has multiple versions 33.2.1-jre, 31.1-jre
Please remove duplicate artifacts from the artifact list so you do not get unexpected artifact versions

If the user uses duplicate_version_warning = "error", they will be unable to resolve the error unless they use a different name for their maven repository.

(When using a non-default name for the maven repository, e.g. maven.install(name = "java", ...), those artifacts are not included.)

Where are these artifacts coming from? They seem to be needed and included by rules_jvm_external itself. Can we remove them or move them to another name so they don't conflict with the user specified artifacts by default? While it's possible to work around this behaviour by specifying a custom name for the maven repository, I think that the default behaviour should avoid surprising users and not include extra artifacts.

[shs96c]

The messages printed to the console tell you: the extra imports are coming from the protobuf. It should be possible to use bazel mod to determine why the Bazel project has a dependency on that, but it’s likely a transitive dependency of another module that’s being used.

[joca-bt]

It seems there are transitive dependencies on protobuf, which depends back on rules_jvm_external (https://github.com/protocolbuffers/protobuf/blob/main/WORKSPACE#L65).

> bazel mod graph
<root> (test@_)
└───rules_jvm_external@6.1
    ├───bazel_skylib@1.6.1
    │   └───platforms@0.0.9 (*)
    ├───platforms@0.0.9
    │   └───rules_license@0.0.7
    ├───rules_android@0.1.1
    ├───rules_java@7.6.1
    │   ├───bazel_skylib@1.6.1 (*)
    │   ├───platforms@0.0.9 (*)
    │   ├───rules_license@0.0.7 (*)
    │   ├───bazel_features@1.11.0
    │   │   └───bazel_skylib@1.6.1 (*)
    │   ├───rules_cc@0.0.9
    │   │   └───platforms@0.0.9 (*)
    │   └───rules_proto@5.3.0-21.7
    │       ├───bazel_skylib@1.6.1 (*)
    │       ├───rules_cc@0.0.9 (*)
    │       └───protobuf@21.7
    │           ├───bazel_skylib@1.6.1 (*)
    │           ├───rules_cc@0.0.9 (*)
    │           ├───rules_pkg@0.7.0 (*)
    │           ├───rules_python@0.23.1 (*)
    │           ├───abseil-cpp@20211102.0
    │           │   ├───platforms@0.0.9 (*)
    │           │   └───rules_cc@0.0.9 (*)
    │           ├───googletest@1.11.0
    │           │   ├───abseil-cpp@20211102.0 (*)
    │           │   ├───platforms@0.0.9 (*)
    │           │   └───rules_cc@0.0.9 (*)
    │           ├───upb@0.0.0-20220923-a547704
    │           │   ├───abseil-cpp@20211102.0 (*)
    │           │   ├───bazel_skylib@1.6.1 (*)
    │           │   └───platforms@0.0.9 (*)
    │           └───zlib@1.3
    │               ├───platforms@0.0.9 (*)
    │               └───rules_cc@0.0.9 (*)
    ├───rules_kotlin@1.9.0
    │   ├───bazel_skylib@1.6.1 (*)
    │   ├───platforms@0.0.9 (*)
    │   ├───rules_cc@0.0.9 (*)
    │   ├───rules_java@7.6.1 (*)
    │   ├───rules_proto@5.3.0-21.7 (*)
    │   ├───stardoc@0.5.6 (*)
    │   ├───rules_pkg@0.7.0
    │   │   ├───bazel_skylib@1.6.1 (*)
    │   │   ├───rules_license@0.0.7 (*)
    │   │   └───rules_python@0.23.1 (*)
    │   └───rules_python@0.23.1
    │       ├───bazel_skylib@1.6.1 (*)
    │       ├───platforms@0.0.9 (*)
    │       ├───protobuf@21.7 (*)
    │       └───rules_proto@5.3.0-21.7 (*)
    └───stardoc@0.5.6
        ├───bazel_skylib@1.6.1 (*)
        ├───rules_java@7.6.1 (*)
        └───rules_license@0.0.7 (*)

Will ask if they can use a different maven repository name (protocolbuffers/protobuf#17117).

[joca-bt]

This can be solved (workaround) by manual fixing the protobuf dependency version to a more recent version. Proper fix requires updating all dependencies that depend on protobuf.