You can't have two different versions of the same dependency at the top level. For example, if there is a direct dependency on Foo 2.0 and direct dependency Bar 1.0 exports Foo 1.0, then you fail to compile and the user must manually select one. However this also comes into play with automatic modules. Automatic modules get all of their deps places on the unnamed module path, meaning they're all exported and programs can rely on them. There are a few ways out of this:
- Patch in a
module-info.javafile into the jar to make the dependencies explicit. This allows the user to once again have different versions of the same jar in their application (assuming they're not both exported). This requires manual action though - Require the user to explicitly import the dependency. This forces resolution to a specific version and makes things more explicit. However, it also means that the user needs to lookup what version of the transitive dep is being used by their direct dep. This could be solved somewhat by tooling.
- Require the user to declare uses of transitive dependencies. This can be configured inline with the dependency declaration and only require the group ID and artifact ID. The version would be whatever the parent dep requires