contrib_rules_jvm dependencies visible in build targets

[sbridges]

I have some protocol buffer files generated with an older version of protoc. Compiling those fails if when I add contrib_rules_jvm to MODULES.bazel. I think contrib_rules_jvm is loading a different version of protocol buffers, and that version is added as a dependency when compiling the java_library.

You can reproduce with the following archive,

test-archive.zip

bazel build ... fails with

foo/FooOuterClass.java:99: error: cannot find symbol
        makeExtensionsImmutable();

If I comment out bazel_dep(name = "contrib_rules_jvm", version = "0.28.0") in MODULE.bazel, then bazel build ... succeeds.

[sgao103]

I am also getting this when I upgrade past version 0.27.0. Here's an example & repro of what I'm seeing:

galc_example.zip

MODULE.bazel imports com.google.auth:google-auth-library-credentials:1.37.1 & FooClass.java references com.google.auth.ApiKeyCredentials (added in 1.27.0).

Bazel correctly imports 1.37.1 when on version ≤ 0.27.0, but when bumped past 0.28.0, the library gets downgraded to 1.24.1, causing these errors at compile time (as well as various NoClassDefFoundErrors at runtime):

foo/FooClass.java:3: error: cannot find symbol
import com.google.auth.ApiKeyCredentials;
                      ^
  symbol:   class ApiKeyCredentials
  location: package com.google.auth
foo/FooClass.java:6: error: cannot find symbol
  ApiKeyCredentials credentials;
  ^
  symbol:   class ApiKeyCredentials
  location: class FooClass

The libraries that I've encountered these errors with (netty, grpc, truth, google-auth-library-credentials, etc) are also dependencies here.

[shs96c]

This should be fixed by the next release of rules_jvm_external