Can i make a Gradle dependencies' dependency to force a version?

Question

Is it possible to force use a sub-dependency's version in Gradle?

Scenario: We are using Dozer and the max version of it is 5.5.1, it has a dependency for commons-beanutils 1.9.1, unfortunately, our Sonatype CLM/IQ server has detected it has a security issue number CVE-2014-0114

Description: (Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.)

Is it possible to update it's dependency version into 1.9.3 to avoid having this security flaw?

Code:

dependencies {
  providedCompile(
     <other stuff>
     [group: 'net.sf.dozer', name: 'dozer', version: '5.5.1']
     <other stuff>
  )
}

Answer 1

In your build.gradle:

configurations.all {
  resolutionStrategy.eachDependency { DependencyResolveDetails details ->
   if (details.requested.name == 'commons-beanutils') {
      details.useTarget "commons-beanutils:commons-beanutils:1.9.3"
   }
  }
}

The transitive dependency versioning solution works, its just that you need to rebuild and refresh your project for Sonatype CLM to detect the changes.