Messaging fails build with latest 29.2.0 release, 29.1.0 is fine [solved, 29.2.1 works]

[mikehardy]

[READ] Step 1: Are you in the right place?

This is the right place

[REQUIRED] Step 2: Describe your environment

• Android Studio version: current stable, also not relevant for this issue
• Firebase Component: Messaging
• Component version: BoM 29.2.0, Messaging is 23.0.1

[REQUIRED] Step 3: Describe the problem

For some reason the messaging component in BoM 29.2.0 leaks in httpcomponents transitive dependencies which have an APK packaging issue with regard to multiple META-INF/DEPENDENCIES files. It looks like it has been a known issue historically as there is an attempt in your build.gradle to exclude them. For some reason that isn't working on 29.2.0, even though it works on 29.1.0 (you can switch between the two BoMs in your messaging quickstart to witness success v failure)

Steps to reproduce:

This is me showing you the reproduction using your quickstart-android repository, cloned just now with a visible diff so you can see the changes required to reproduce:

mike@osxvm-spare:~/work/Invertase/quickstart-android/messaging (master *) % ./gradlew assembleDebug
> Task :app:mergeDebugJavaResource FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':app:mergeDebugJavaResource'.
> A failure occurred while executing com.android.build.gradle.internal.tasks.MergeJavaResWorkAction
   > 2 files found with path 'META-INF/DEPENDENCIES' from inputs:
      - /Users/mike/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.5.11/f6d42fee5110c227bac18a550a297e028f2fb21a/httpclient-4.5.11.jar
      - /Users/mike/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpcore/4.4.13/853b96d3afbb7bf8cc303fe27ee96836a10c1834/httpcore-4.4.13.jar
     Adding a packagingOptions block may help, please refer to
     https://google.github.io/android-gradle-dsl/current/com.android.build.gradle.internal.dsl.PackagingOptions.html
     for more information

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

* Get more help at https://help.gradle.org

BUILD FAILED in 28s
81 actionable tasks: 12 executed, 69 up-to-date
mike@osxvm-spare:~/work/Invertase/quickstart-android/messaging (master *) % git diff
diff --git a/messaging/app/build.gradle b/messaging/app/build.gradle
index 02fc3ef3..539dd098 100644
--- a/messaging/app/build.gradle
+++ b/messaging/app/build.gradle
@@ -11,7 +11,7 @@ android {
 
     defaultConfig {
         applicationId "com.google.firebase.quickstart.fcm"
-        minSdkVersion 16
+        minSdkVersion 19
         targetSdkVersion 30
         versionCode 1
         versionName "1.0"
@@ -50,7 +50,7 @@ dependencies {
     implementation 'com.google.android.material:material:1.4.0'
 
     // Import the Firebase BoM (see: https://firebase.google.com/docs/android/learn-more#bom)
-    implementation platform('com.google.firebase:firebase-bom:28.3.0')
+    implementation platform('com.google.firebase:firebase-bom:29.2.0')
 
     // Firebase Cloud Messaging (Java)
     implementation 'com.google.firebase:firebase-messaging'
diff --git a/messaging/gradle.properties b/messaging/gradle.properties
index aac7c9b4..c7fb972d 100644
--- a/messaging/gradle.properties
+++ b/messaging/gradle.properties
@@ -15,3 +15,5 @@ org.gradle.jvmargs=-Xmx1536m
 # This option should only be used with decoupled projects. More details, visit
 # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
 # org.gradle.parallel=true
+
+android.useAndroidX=true
\ No newline at end of file

Relevant Code:

Your quickstart helpfully provides the relevant code to reproduce, see above.

It's very strange to me that this dependency is creeping in. I did ./gradlew :app:dependencies on BoM 29.1.0 and 29.2.0 and diffed them, and sure enough it comes in on 29.2.0 only, here's a relevant chunk of that diff:

5337,5343c5407,5436
< |         +--- com.google.android.datatransport:transport-backend-cct:3.0.0 -> 3.1.2 (*)
< |         +--- com.google.android.datatransport:transport-runtime:3.0.0 -> 3.1.2 (*)
< |         +--- com.google.android.gms:play-services-basement:17.0.0 -> 18.0.0 (*)
< |         +--- com.google.android.gms:play-services-cloud-messaging:17.0.0 (*)
< |         +--- com.google.android.gms:play-services-stats:17.0.0 -> 17.0.2 (*)
< |         +--- com.google.android.gms:play-services-tasks:17.0.0 -> 18.0.1 (*)
< |         +--- com.google.firebase:firebase-common:20.0.0 (*)
---
> |         +--- com.google.android.datatransport:transport-backend-cct:3.1.2 (*)
> |         +--- com.google.android.datatransport:transport-runtime:3.1.2 (*)
> |         +--- com.google.android.gms:play-services-base:18.0.1 (*)
> |         +--- com.google.android.gms:play-services-basement:18.0.0 (*)
> |         +--- com.google.android.gms:play-services-cloud-messaging:17.0.1 (*)
> |         +--- com.google.android.gms:play-services-stats:17.0.2 (*)
> |         +--- com.google.android.gms:play-services-tasks:18.0.1 (*)
> |         +--- com.google.api-client:google-api-client:1.30.9
> |         |    +--- com.google.oauth-client:google-oauth-client:1.30.5
> |         |    |    +--- com.google.http-client:google-http-client:1.34.0 -> 1.34.2
> |         |    |    |    +--- org.apache.httpcomponents:httpclient:4.5.11
> |         |    |    |    |    +--- org.apache.httpcomponents:httpcore:4.4.13

Adding:
exclude 'META-INF/DEPENDENCIES'

to packagingOptions in build.gradle works around the issue, but it's a regression causing a build failure on update from BoM 29.1.0 to 29.2.0. What changed 🤔

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[argzdev]

Hi @mikehardy, thanks for reporting. I was able to reproduce the same issue, I'll notify an engineer to see what we can do here.

[mikehardy]

For what it's worth, I investigated adding the packagingOptions { exclude 'META-INF/DEPENDENCIES' } workaround to the build.gradle in react-native-firebase's messaging package right about here so I could release 29.2.0 to users without transitively breaking their builds and unfortunately it was disregarded by android gradle plugin, the build still failed.

The only way the workaround works is in the final app's build.gradle verified by temporarily adding it in our e2e test harness here as a temporary (un-committed) check.

So this is a blocker for react-native-firebase to adopt new firebase-android-sdk BoMs

[adriancretu]

Not sure how this ended up as a release version, since it's breaking basically any Android build in the known galaxy that tries to use BoM 29.2.0. Also, httpcomponents is not needed on Android, needs to be excluded entirely as a group, the same goes with httpclient-gson and http-client-apache2. Those libs are only relevant for desktop apps. The entire problem is the need to use the Google API client which is a generic library, not Android-oriented.

[carlonzo]

FYI here are the new dependencies that have been added with this BoM, which adds 2MB of dex in our APK.

New Dependencies
com.fasterxml.jackson.core:jackson-core:2.10.2
com.google.api-client:google-api-client:1.30.9
com.google.code.findbugs:jsr305:3.0.2
com.google.errorprone:error_prone_annotations:2.3.4
com.google.guava:failureaccess:1.0.1
com.google.guava:guava:28.2-android
com.google.http-client:google-http-client:1.34.2
com.google.http-client:google-http-client-jackson2:1.34.2
com.google.j2objc:j2objc-annotations:1.3
com.google.oauth-client:google-oauth-client:1.30.5
commons-codec:commons-codec:1.11
commons-logging:commons-logging:1.2
io.grpc:grpc-context:1.22.1
io.opencensus:opencensus-api:0.24.0
io.opencensus:opencensus-contrib-http-util:0.24.0
org.apache.httpcomponents:httpclient:4.5.11
org.apache.httpcomponents:httpcore:4.4.13
org.checkerframework:checker-compat-qual:2.5.5

[yifanyang]

@VinayGuthal Since you have the most context on FCM, can you take a look at this issue?

[argzdev]

Just an update, VinayGuthal has created a PR at #3533.

[mikehardy]

Wonderful @argzdev I just took a look, given what I know of native android and gradle (a fair bit, but...software can surprise you) that looks like a good fix. I'll give the 29.2.1 BoM a test when it's out

[AlexeyGodyaev]

com.google.firebase:firebase-messaging-ktx:23.0.1

A failure occurred while executing com.android.build.gradle.internal.tasks.MergeJavaResWorkAction
2 files found with path 'META-INF/DEPENDENCIES' from inputs:
- /Users/demonel/.gradle/caches/transforms-3/85fd090bdf13ddf3bde3110d4fa331ed/transformed/jetified-httpclient-4.5.11.jar
- /Users/demonel/.gradle/caches/transforms-3/b3ff405347a5ae1fe824624501c9a576/transformed/jetified-httpcore-4.4.13.jar

[mikehardy]

@AlexeyGodyaev that looks like the same report of the original issue. I believe there is a pull request already merged to fix it and we are just waiting on release now.

In fact, that brings up the question - @VinayGuthal / @argzdev - I understand release time lines are fluid, and setting expectations is dangerous so please know I understand anything you say could move a bunch, but do you have an idea for release on this? (like "a few days", "a week or two", "next month" etc) :-), thanks

[mikehardy]

29.2.1 builds without the unexpected transitive dependencies. I appear to be unable to connect to the firebase emulator suite for auth with 29.2.1, but that's obviously separate. I'll do what I can to triage and post up a reproducible issue if I can prove it's not something we're doing in react-native-firebase. Cheers for this fix!