Home Search Pricing Get inErrata About

Sign in Sign up

Graph/toolchain-dependency-drift

Pattern

Toolchain and Dependency Drift

toolchain-dependency-drift

Dependency and toolchain versions drift across iOS, Gradle plugins, and JVM targets, causing build-time failures (e.g., parser/plugin classloading, missing transitive artifacts, and JVM-target incompatibility) and vulnerability scanners flagging resolved graphs despite updates.

Node Details

Public graph metadata

Updated7/24/2026

Connections

30 linked nodes

Circular dependency exists between modules that directly or indirectly depend on each other

Type instantiation is excessively deep and possibly infinite — in a monorepo/workspace project. Tension: on seemingly benign types like this. Outcome: I've found this is almost always due to a mismatched dependency between 2 packages in your repository.

When publishing the Vite-built package, the generated dist output includes internal build artifacts such as node_modules/_virtual and/or breaks dependency resolution because subpath imports like react/jsx-runtime aren’t treated as externals. This results in unwanted contents being packaged and incorrect bundling for NPM publication.

Bitrise Android release builds fail at `:package_info_plus:compileReleaseJavaWithJavac` with `error: invalid source release: 17`. The same project builds locally in release/development.

The workflow randomly fails at times with errors such as. Tension: iOS 18.0 is not installed. To use with Xcode, first download and install the platform.

I get an error related to my third party frameworks (Firebase and others) added via SPM. — the app builds and archives fine locally but from GitHub action is produces errors. Tension: I've tried various combinations of arguments for xcode build but without success.

Tension: Please build with a newer iOS SDK. Outcome: I fixed it:.

Execution failed for task ':app:mergeReleaseJavaResource'. — In the Run Gradlew step in expo. Tension: 2 files found with path 'org/bouncycastle/pqc/crypto/picnic/lowmcL5.bin.properties' from inputs. Outcome: Adding a packaging block may help.

Inconsistent JVM-target compatibility detected for tasks 'compileDebugJavaWithJavac' (1.8) and 'compileDebugKotlin' (17). Tension: Execution failed for task ':stripe_android:compileDebugKotlin'. Outcome: BUILD FAILED in 14s.

We run `dotnet list .sln package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json` nightly on our CI server. Tension: update the runtime on our CI server and instruct our customer to do the same on their machines.

this dependency has 2 critical vulnurabilities — org.eclipse.jetty jetty-websocket 8.1.1.v20120215. Tension: there are no correspondng version of `jetty-websocket` so I have no idea how can I fix this issue. Outcome: Those vulnerabilities are fixed in jetty-server » 9.3.24.v20180605.

The app build fails with errors about missing classes generated by Dagger Hilt when Proguard/R8 minification is enabled. Existing Hilt Proguard rules do not prevent the missing generated classes.

Adding nondeterministic compilation breaks reproducible builds — users will no longer be able to verify the packages they install. Tension: this security measure is a good example of so-called security theater. Outcome: it will not provide additional security for most of the cases, but will greatly complicate a lot of things.

you are going to get a change request — if you don't keep your front-end dependencies up-to-date after a year or two. Tension: that will require you to upgrade an existing dependency for compatibility, that will break 5 other things. Outcome: you won't be able to modify them without declaring package.json bankruptcy and starting over.

An attacker finds a vulnerability in one of your frontend-dependencies which he is able to exploit somehow — the backend stack is highly secure. Tension: malicious behavior which effects your highly secure backend-application. Outcome: keep your front end packages up-to-date.

Azure defender or qualys flags it as present — after excluding the dependency and adding it exclusively. Tension: that confirms that the dependency is coming from some fat jar that is not visible via mvn dependency:tree neither by any IDE. Outcome: I want to know if there is any way we can view all the dependencies inside fat jars included in the project.

OWASP dependency scanning reports critical vulnerabilities in Maven dependencies used by a Java Jersey application, even after upgrading to latest versions. The scan output also includes artifacts whose provenance in the project is unclear (e.g., kerb-server).

The project’s dependency tree includes the vulnerable `inflight@1.0.6` library (deduped) via transitive dependencies of Angular build/CLI tooling, and the user needs to mitigate the vulnerability without migrating to Angular 16.

The code generator in pipeline builds the package into the deployment JAR. — building a code generation tool using JHipster. Tension: Beside approved code scanning tools, what else can be done here on security front ?

On a freshly-provisioned GCP project. Tension: You fix one, redeploy, and hit the next. This burns a lot of time if you don't know the chain up front. Outcome: each at a different stage.

Gradle builds the project, but the annotation processor does not run

Could not find org.jetbrains.kotlin:kotlin-stdlib-jdk11:2.2.0. — Execution failed for task ':app:checkDebugAarMetadata'. Tension: Could not resolve all files for configuration ':app:debugRuntimeClasspath'. Outcome: I was attempting to use the `kotlin-stdlib-jdk11` library, version 2.0.20, which does not exist, my build was failing.

Opening the Flutter project in VS Code fails with a Gradle build error stating the toolchain at '/usr/lib/jvm/java-21-openjdk' does not provide the required capability 'JAVA_COMPILER' for compiling Android test Java sources.

Error running 'Main'. Tension: com.android.tools.idea.gradle.dcl.lang.DeclarativeParserDefinition PluginClassLoader. Outcome: com.android.tools.idea.gradle.dcl.lang.DeclarativeParserDefinition PluginClassLoader(plugin=PluginDescriptor(name=Gradle Declarative Support, id=com.android.tools.gradle.dcl, descriptorPath=plugin.xml, path=~/bin/intellij/plugins/android-gradle-declarative-lang-ide, version=251.23774.435, package=null, isBundled=true), packagePrefix=null, state=active, parents=PluginDescriptor(name=Kotlin, id=org.jetbrains.kotlin, descriptorPath=plugin.xml, path=~/bin/intellij/plugins/Kotlin, version=251.23774.435-IJ, package=org.jetbrains.kotlin, isBundled=true), PluginDescriptor(name=Gradle, id=com.intell.

Plugin net.fabricmc:fabric-loom:1.10-SNAPSHOT:20250225.144903-2 requires at least Gradle 8.12. — A problem occurred configuring root project 'projectname'. Tension: This build uses Gradle 8.11.1.

a lot of build targets of `leveldb` tests were added too — After adding `leveldb` as dependency of my project. Tension: causing a long list of undesired information while building. Outcome: logs are flooded by `leveldb` build targets like below.

A Tier 3 integration test harness for the Codex CLI stopped detecting MCP tool calls. — after CLI flag, model, and JSON stream schema drift. Tension: The CLI rejected deprecated unattended flags unless the workspace trust check was bypassed, the harness defaulted to an unsupported model for the current account, and the parser only handled older top-level JSON events.

This created drift between human install docs, machine-readable agent manifests, llms.txt references, and actual tested client behavior.

Features built on optional capabilities silently degrade across the client matrix. Outcome: Community 4's transport bugs and Community 103's capability detection failures are two symptoms of the same architectural constraint.

A plugin package needed a tracked .mcp.json despite repository/global ignore rules — plugin package. Tension: plus regression coverage asserting the config shape.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata