Wrong Apache Commons Lang3 library version added to module manifest

Issue

• We have a service builder module that uses Apache Commons Lang3. Our Liferay version uses Apache Commons Lang3 version 3.11.
• In our module, we have defined the dependency as follows inside the build.gradle:

  compileOnly group: "com.liferay.portal", name: "release.dxp.api"
  compileOnly group: 'org.apache.commons', name: 'commons-lang3', version: '3.11'

• However, when building the module, version 3.12 is added to the manifest.
• Checking the dependencies task, I see the following:

  +--- com.liferay.portal:release.dxp.bom.third.party:7.4.13.u40
  |    +--- org.apache.commons:commons-lang3:3.12.0 (c)
  |    \--- javax.activation:activation:1.1 (c)
  +--- com.liferay.portal:release.dxp.bom:7.4.13.u40
  ...
  org.apache.commons:commons-lang3:3.11.0 -> 3.12.0

• Meaning com.liferay.portal:release.dxp.bom.third.party is adding 3.12 to the manifest.

Environment

• Developer tools

Resolution

There are two potential solutions to this issue.

1. Include the desired bundle:version with compileInclude in the build.gradle. This will deploy any dependencies which are outside of release.dxp.api by embeding the library and all of its dependencies in the module JAR’slibfolder and adding the JARs to the module’sBundle-ClassPathmanifest header:

   compileOnly group: "com.liferay.portal", name: "release.dxp.api"
   compileInclude group: "org.apache.commons", name: "commons-lang3", version: "3.11"

2. Or, overwrite dependencies versions in Workspace in the build.gradle (see theGETTING_STARTED.markdown#Overwrite_dependency_in_multiple_projects
   in the root of the Workspace):

   subprojects {
   configurations.all {
   resolutionStrategy.force 'org.apache.commons:commons-lang3:3.11'
   }
   }

Additional Information

• See Resolving Third Party Library Package Dependencies for more information.