From 2cc24a9bda85a5bf149b1dae49c0d2e4a2c449a9 Mon Sep 17 00:00:00 2001
From: Eric Anderson <ejona@google.com>
Date: Sat, 6 May 2023 16:17:10 -0700
Subject: [PATCH] gradle: Remove version pinning from POMs

The pinning is unreliable in Maven and ignored by Gradle. I'm not at all
convinced that we are pinning/not pinning in appropriate projects. The
pinning also serves less of a purpose since we started encouraging the
BOM and grpc-netty-shaded. Netty's HTTP/2 API has also become somewhat
stable compared to its earlier history. If we notice an up-tick in
version skew, we can reinstate it.

The pinning is annoying in the build.gradle code and causes Maven/Gradle
to download the version list once a day, which can be troublesome to
users unaware of how to tell the tools to work offline.

It also opens our users to platform issues like seen in #10043
and #10086 where Maven Central's version list was incorrectly generated.
Or like #9664 where Gradle Plugin's repository caches packages from
JCenter but the version list is not as cachable so exposed us to JCenter
instability.

This fixes #8357, by way of "we think we won't worry any more." See
90db93b9 when it was originally introduced. And issues
like #8337, #3634.
---
 alts/build.gradle         |  3 +--
 build.gradle              | 15 ---------------
 googleapis/build.gradle   | 17 -----------------
 netty/shaded/build.gradle |  9 ---------
 xds/build.gradle          |  3 +--
 5 files changed, 2 insertions(+), 45 deletions(-)

diff --git a/alts/build.gradle b/alts/build.gradle
index 4ae91fee29..2b48403d91 100644
--- a/alts/build.gradle
+++ b/alts/build.gradle
@@ -95,8 +95,7 @@ publishing {
                     def dependencyNode = dependenciesNode.appendNode('dependency')
                     dependencyNode.appendNode('groupId', dep.group)
                     dependencyNode.appendNode('artifactId', dep.name)
-                    def version = (dep.name == 'grpc-netty-shaded') ? '[' + dep.version + ']' : dep.version
-                    dependencyNode.appendNode('version', version)
+                    dependencyNode.appendNode('version', dep.version)
                     dependencyNode.appendNode('scope', 'compile')
                 }
                 asNode().dependencies[0].replaceNode(dependenciesNode)
diff --git a/build.gradle b/build.gradle
index ba615d676f..1940b613e8 100644
--- a/build.gradle
+++ b/build.gradle
@@ -355,21 +355,6 @@ subprojects {
                                 organizationUrl = "https://www.google.com"
                             }
                         }
-
-                        withXml {
-                            if (!(project.name in
-                            [
-                                "grpc-stub",
-                                "grpc-protobuf",
-                                "grpc-protobuf-lite",
-                            ])) {
-                                asNode().dependencies.'*'.findAll() { dep ->
-                                    dep.artifactId.text() in ['grpc-api', 'grpc-core']
-                                }.each() { core ->
-                                    core.version*.value = "[" + core.version.text() + "]"
-                                }
-                            }
-                        }
                     }
                 }
             }
diff --git a/googleapis/build.gradle b/googleapis/build.gradle
index 027b518552..540011986c 100644
--- a/googleapis/build.gradle
+++ b/googleapis/build.gradle
@@ -17,20 +17,3 @@ dependencies {
 
     signature libraries.signature.java
 }
-
-publishing {
-    publications {
-        maven(MavenPublication) {
-            pom {
-                withXml {
-                    // Since internal APIs are used, pin the version.
-                    asNode().dependencies.'*'.findAll() { dep ->
-                        dep.artifactId.text() in ['grpc-alts', 'grpc-xds']
-                    }.each() { core ->
-                        core.version*.value = "[" + core.version.text() + "]"
-                    }
-                }
-            }
-        }
-    }
-}
diff --git a/netty/shaded/build.gradle b/netty/shaded/build.gradle
index 2feddf4cd3..10410c959d 100644
--- a/netty/shaded/build.gradle
+++ b/netty/shaded/build.gradle
@@ -111,15 +111,6 @@ publishing {
                     core.scope*.value = "compile"
                 }
             }
-
-            // shadow.component() is run after the main build.gradle's withXml
-            pom.withXml {
-                asNode().dependencies.'*'.findAll() { dep ->
-                    dep.artifactId.text() in ['grpc-api', 'grpc-core']
-                }.each() { core ->
-                    core.version*.value = "[" + core.version.text() + "]"
-                }
-            }
         }
     }
 }
diff --git a/xds/build.gradle b/xds/build.gradle
index fa0d7b545a..a33fa6e6d5 100644
--- a/xds/build.gradle
+++ b/xds/build.gradle
@@ -247,8 +247,7 @@ publishing {
                     def dependencyNode = dependenciesNode.appendNode('dependency')
                     dependencyNode.appendNode('groupId', dep.group)
                     dependencyNode.appendNode('artifactId', dep.name)
-                    def version = (dep.name == 'grpc-netty-shaded') ? '[' + dep.version + ']' : dep.version
-                    dependencyNode.appendNode('version', version)
+                    dependencyNode.appendNode('version', dep.version)
                     dependencyNode.appendNode('scope', 'compile')
                 }
                 asNode().dependencies[0].replaceNode(dependenciesNode)