Upgrading google-auth-library to 0.25.2

[suztomo]

Fixes #8037

[suztomo]

Travis failed:

Could not determine the dependencies of task ':grpc-alts:shadowJar'.
> Could not resolve all dependencies for configuration ':grpc-alts:runtimeClasspath'.
   > Conflict(s) found for the following module(s):
       - org.apache.httpcomponents:httpcore between versions 4.4.14 and 4.4.13
     Run with:
         --scan or
         :grpc-alts:dependencyInsight --configuration runtimeClasspath --dependency org.apache.httpcomponents:httpcore
     to get more insight on how to solve the conflict.

Why would Gradle complain the version difference? Gradle picks the highest version, doesn't it?

This is because grpc-java uses Gradle's failOnVersionConflict strategy.

    configurations {
        // Detect Maven Enforcer's dependencyConvergence failures. We only
        // care for artifacts used as libraries by others.
        if (isAndroid && !(project.name in ['grpc-android-interop-testing'])) {
            releaseRuntimeClasspath {
                resolutionStrategy.failOnVersionConflict()
            }
        }
        if (!isAndroid && !(project.name in [
                'grpc-benchmarks',
                'grpc-interop-testing',
                'grpc-gae-interop-testing-jdk8',
        ])) {
            runtimeClasspath {
                resolutionStrategy.failOnVersionConflict()
            }
        }
    }

suztomo-macbookpro44% ./gradlew :grpc-alts:dependencyInsight --configuration runtimeClasspath --dependency org.apache.httpcomponents:httpcore
...
org.apache.httpcomponents:httpcore:4.4.14
\--- com.google.http-client:google-http-client:1.39.1
     +--- com.google.auth:google-auth-library-oauth2-http:0.25.2
     |    \--- runtimeClasspath
     \--- com.google.http-client:google-http-client-gson:1.39.1
          \--- com.google.auth:google-auth-library-oauth2-http:0.25.2 (*)

org.apache.httpcomponents:httpcore:4.4.13 -> 4.4.14
\--- org.apache.httpcomponents:httpclient:4.5.13
     \--- com.google.http-client:google-http-client:1.39.1
          +--- com.google.auth:google-auth-library-oauth2-http:0.25.2
          |    \--- runtimeClasspath
          \--- com.google.http-client:google-http-client-gson:1.39.1
               \--- com.google.auth:google-auth-library-oauth2-http:0.25.2 (*)

httpcomponents-client apache/httpcomponents-client@2927359 has upgraded org.apache.httpcomponents:httpclient's httpcore version. It seems the library has not yet been published.

Problem is that com.google.http-client:google-http-client:1.39.1's dependency does not have dependency convergence.

• com.google.http-client:google-http-client:1.39.1 -> org.apache.httpcomponents:httpclient:4.5.13 -> org.apache.httpcomponents:httpcore:4.4.13
• com.google.http-client:google-http-client:1.39.1 -> org.apache.httpcomponents:httpcore:4.4.14

It's not gRPC's dependency or google-auth-library-oauth2-http. Any gradle project with failOnVersionConflict cannot declare dependency with com.google.http-client:google-http-client:1.39.1

Apache HTTP Client team does not have upcoming release for 4.X release (I asked mailing list)

[suztomo]

This needs an httpclient release. Closing this for now.