Dependency Analysis of com.google.auth:google-auth-library-appengine:1.36.0

BOM: com.google.cloud:libraries-bom:26.62.0

Global Upper Bounds Check

For each transitive dependency the library pulls in, the highest version found anywhere in the union of the BOM's dependency trees is picked.

Global Upper Bounds Fixes

Suggested updates to bring this artifact into sync with the highest versions of its dependencies used by any artifact in the BOM:

Upgrade com.google.errorprone:error_prone_annotations:jar:2.37.0 to version "2.38.0":
Add this dependency element to the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0:
```
<dependency>
<groupId>com.google.errorprone</groupId>
<artifactId>error_prone_annotations</artifactId>
<version>2.38.0</version>
</dependency>
```
If the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0 already includes this dependency, update the version of the existing dependency element. Otherwise add a new dependency element to the dependencyManagement section.
Upgrade com.google.guava:guava:jar:33.4.0-android to version "33.4.0-jre":
Add this dependency element to the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0:
```
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>33.4.0-jre</version>
</dependency>
```
If the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0 already includes this dependency, update the version of the existing dependency element. Otherwise add a new dependency element to the dependencyManagement section.
Upgrade commons-codec:commons-codec:jar:1.11 to version "1.18.0":
Add this dependency element to the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0:
```
<dependency>
<groupId>commons-codec</groupId>
<artifactId>commons-codec</artifactId>
<version>1.18.0</version>
</dependency>
```
If the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0 already includes this dependency, update the version of the existing dependency element. Otherwise add a new dependency element to the dependencyManagement section.
Upgrade io.grpc:grpc-api:jar:1.70.0 to version "1.71.0":
Add this dependency element to the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0:
```
<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-api</artifactId>
<version>1.71.0</version>
</dependency>
```
If the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0 already includes this dependency, update the version of the existing dependency element. Otherwise add a new dependency element to the dependencyManagement section.
Upgrade io.grpc:grpc-context:jar:1.70.0 to version "1.71.0":
Add this dependency element to the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0:
```
<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-context</artifactId>
<version>1.71.0</version>
</dependency>
```
If the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0 already includes this dependency, update the version of the existing dependency element. Otherwise add a new dependency element to the dependencyManagement section.
Upgrade org.checkerframework:checker-qual:jar:3.43.0 to version "3.49.0":
Add this dependency element to the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0:
```
<dependency>
<groupId>org.checkerframework</groupId>
<artifactId>checker-qual</artifactId>
<version>3.49.0</version>
</dependency>
```
If the pom.xml for com.google.auth:google-auth-library-appengine:1.36.0 already includes this dependency, update the version of the existing dependency element. Otherwise add a new dependency element to the dependencyManagement section.

Local Upper Bounds Check

For each transitive dependency the library pulls in, the highest version found anywhere in the dependency tree is picked.

com.google.auth:google-auth-library-appengine:1.36.0 selects the highest version of all dependencies.

Dependency Convergence

There is exactly one version of each dependency in the library's transitive dependency tree. That is, two artifacts with the same group ID and artifact ID but different versions do not appear in the tree. No dependency mediation is necessary.

Suggested Dependency Updates

Caution: The algorithm for suggesting updates is imperfect. They are not ordered by importance, and one change may render another moot.

Suggested updates to bring this artifact and its dependencies into sync with the highest versions of each dependency found in its own dependency tree:

com.google.http-client:google-http-client-gson:1.47.0 needs to upgrade com.google.code.gson:gson:2.11.0 to 2.12.1
com.google.guava:guava:33.4.0-android needs to upgrade com.google.errorprone:error_prone_annotations:2.36.0 to 2.37.0
com.google.http-client:google-http-client:1.47.0 needs to upgrade com.google.errorprone:error_prone_annotations:2.36.0 to 2.37.0
com.google.code.gson:gson:2.12.1 needs to upgrade com.google.errorprone:error_prone_annotations:2.36.0 to 2.37.0
io.opencensus:opencensus-contrib-http-util:0.31.1 needs to upgrade com.google.guava:guava:29.0-android to 33.4.0-android
com.google.http-client:google-http-client:1.47.0 needs to upgrade com.google.guava:guava:30.1.1-android to 33.4.0-android
io.opencensus:opencensus-api:0.31.1 needs to upgrade io.grpc:grpc-context:1.27.2 to 1.70.0

Linkage Check

17 linkage error(s)

com.google.appengine:appengine-api-1.0-sdk:2.0.33

17 target classes causing linkage errors referenced from 38 source classes.

Class javax.activation.DataSource is not found, referenced from 11 classes

Class org.apache.avalon.framework.logger.Logger is not found, referenced from com.google.appengine.repackaged.org.apache.commons.logging.impl.AvalonLogger

Class org.apache.log.Hierarchy is not found, referenced from com.google.appengine.repackaged.org.apache.commons.logging.impl.LogKitLogger

Class org.apache.log.Logger is not found, referenced from com.google.appengine.repackaged.org.apache.commons.logging.impl.LogKitLogger

Class com.google.appengine.repackaged.com.google.common.time.Durations is not found, referenced from com.google.appengine.repackaged.com.google.common.flags.ext.DurationFlag

Class libcore.io.Memory is not found, referenced from 2 classes

Class com.google.appengine.repackaged.com.google.common.logging.syslog.SyslogUtilModule is not found, referenced from com.google.appengine.repackaged.com.google.protobuf.TextFormat

Class com.google.appengine.repackaged.com.google.common.time.TimeSource is not found, referenced from com.google.appengine.repackaged.com.google.protobuf.util.JavaTimeConversions

Class com.google.apphosting.executor.TaskDefinition is not found, referenced from com.google.storage.onestore.v3.OnestoreAction

Class javax.activation.DataHandler is not found, referenced from 4 classes

Class javax.activation.FileDataSource is not found, referenced from javax.mail.internet.MimeBodyPart

Class javax.activation.ActivationDataFlavor is not found, referenced from 5 classes

Class javax.activation.DataContentHandler is not found, referenced from 3 classes

Class org.antlr.stringtemplate.StringTemplate is not found, referenced from com.google.appengine.repackaged.org.antlr.runtime.tree.DOTTreeGenerator

(com.google.api:gapic-generator-java:2.59.0) com.google.api.FieldBehaviorProto's method "com.google.appengine.repackaged.com.google.protobuf.Descriptors$FileDescriptor getDescriptor()" is expected to return com.google.appengine.repackaged.com.google.protobuf.Descriptors$FileDescriptor but instead returns com.google.protobuf.Descriptors$FileDescriptor, referenced from 2 classes

(com.google.api:gapic-generator-java:2.59.0) com.google.api.ClientProto's method "com.google.appengine.repackaged.com.google.protobuf.Descriptors$FileDescriptor getDescriptor()" is expected to return com.google.appengine.repackaged.com.google.protobuf.Descriptors$FileDescriptor but instead returns com.google.protobuf.Descriptors$FileDescriptor, referenced from com.google.appengine.repackaged.com.google.datastore.v1.DatastoreProto

(com.google.api:gapic-generator-java:2.59.0) com.google.api.RoutingProto's method "com.google.appengine.repackaged.com.google.protobuf.Descriptors$FileDescriptor getDescriptor()" is expected to return com.google.appengine.repackaged.com.google.protobuf.Descriptors$FileDescriptor but instead returns com.google.protobuf.Descriptors$FileDescriptor, referenced from com.google.appengine.repackaged.com.google.datastore.v1.DatastoreProto

The following path contains com.google.api:gapic-generator-java:2.59.0:

com.google.api:gapic-generator-java:2.59.0 (compile)

The following path contains com.google.appengine:appengine-api-1.0-sdk:2.0.33:

com.google.auth:google-auth-library-appengine:1.36.0 (compile) / com.google.appengine:appengine-api-1.0-sdk:2.0.33 (provided)

Dependencies

com.google.auth:google-auth-library-appengine:jar:1.36.0

com.google.auth:google-auth-library-credentials:jar:1.36.0
com.google.auth:google-auth-library-oauth2-http:jar:1.36.0
- com.google.auto.value:auto-value-annotations:jar:1.11.0
- com.google.code.findbugs:jsr305:jar:3.0.2
- com.google.auth:google-auth-library-credentials:jar:1.36.0
- com.google.http-client:google-http-client:jar:1.47.0
  - org.apache.httpcomponents:httpclient:jar:4.5.14
    - org.apache.httpcomponents:httpcore:jar:4.4.16
    - commons-codec:commons-codec:jar:1.11
  - org.apache.httpcomponents:httpcore:jar:4.4.16
  - com.google.code.findbugs:jsr305:jar:3.0.2
  - com.google.errorprone:error_prone_annotations:jar:2.36.0
  - com.google.guava:guava:jar:30.1.1-android
    - com.google.guava:failureaccess:jar:1.0.1
    - com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava
    - com.google.code.findbugs:jsr305:jar:3.0.2
    - org.checkerframework:checker-compat-qual:jar:2.5.5
    - com.google.errorprone:error_prone_annotations:jar:2.5.1
    - com.google.j2objc:j2objc-annotations:jar:1.3
  - com.google.j2objc:j2objc-annotations:jar:3.0.0
  - io.grpc:grpc-context:jar:1.70.0
    - io.grpc:grpc-api:jar:1.70.0
  - io.opencensus:opencensus-api:jar:0.31.1
    - io.grpc:grpc-context:jar:1.27.2
  - io.opencensus:opencensus-contrib-http-util:jar:0.31.1
    - io.opencensus:opencensus-api:jar:0.31.1
      - io.grpc:grpc-context:jar:1.27.2
    - com.google.guava:guava:jar:29.0-android
      - com.google.guava:failureaccess:jar:1.0.1
      - com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava
      - com.google.code.findbugs:jsr305:jar:3.0.2
      - org.checkerframework:checker-compat-qual:jar:2.5.5
      - com.google.errorprone:error_prone_annotations:jar:2.3.4
      - com.google.j2objc:j2objc-annotations:jar:1.3
- com.google.http-client:google-http-client-gson:jar:1.47.0
  - com.google.http-client:google-http-client:jar:1.47.0
    - org.apache.httpcomponents:httpclient:jar:4.5.14
      - org.apache.httpcomponents:httpcore:jar:4.4.16
      - commons-codec:commons-codec:jar:1.11
    - org.apache.httpcomponents:httpcore:jar:4.4.16
    - com.google.code.findbugs:jsr305:jar:3.0.2
    - com.google.errorprone:error_prone_annotations:jar:2.36.0
    - com.google.guava:guava:jar:30.1.1-android
      - com.google.guava:failureaccess:jar:1.0.1
      - com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava
      - com.google.code.findbugs:jsr305:jar:3.0.2
      - org.checkerframework:checker-compat-qual:jar:2.5.5
      - com.google.errorprone:error_prone_annotations:jar:2.5.1
      - com.google.j2objc:j2objc-annotations:jar:1.3
    - com.google.j2objc:j2objc-annotations:jar:3.0.0
    - io.grpc:grpc-context:jar:1.70.0
      - io.grpc:grpc-api:jar:1.70.0
    - io.opencensus:opencensus-api:jar:0.31.1
      - io.grpc:grpc-context:jar:1.27.2
    - io.opencensus:opencensus-contrib-http-util:jar:0.31.1
      - io.opencensus:opencensus-api:jar:0.31.1
        
        io.grpc:grpc-context:jar:1.27.2
      - com.google.guava:guava:jar:29.0-android
        
        com.google.guava:failureaccess:jar:1.0.1
        
        com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava
        
        com.google.code.findbugs:jsr305:jar:3.0.2
        
        org.checkerframework:checker-compat-qual:jar:2.5.5
        
        com.google.errorprone:error_prone_annotations:jar:2.3.4
        
        com.google.j2objc:j2objc-annotations:jar:1.3
  - com.google.code.gson:gson:jar:2.11.0
- com.google.guava:guava:jar:33.4.0-android
  - com.google.guava:failureaccess:jar:1.0.2
  - com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava
  - com.google.code.findbugs:jsr305:jar:3.0.2
  - org.checkerframework:checker-qual:jar:3.43.0
  - com.google.errorprone:error_prone_annotations:jar:2.36.0
- com.google.errorprone:error_prone_annotations:jar:2.37.0
- com.google.code.gson:gson:jar:2.12.1
  - com.google.errorprone:error_prone_annotations:jar:2.36.0
com.google.appengine:appengine-api-1.0-sdk:jar:2.0.33
com.google.guava:guava:jar:33.4.0-android
- com.google.guava:failureaccess:jar:1.0.2
- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava
- com.google.code.findbugs:jsr305:jar:3.0.2
- org.checkerframework:checker-qual:jar:3.43.0
- com.google.errorprone:error_prone_annotations:jar:2.36.0
com.google.errorprone:error_prone_annotations:jar:2.37.0

Last generated at 2025-06-13T14:55:33.900055