Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

oss-licenses-plugin >=0.11.0 breaks configureCMake* on JDK 17: protobuf-java 4.x forced onto AGP's classpath (Failed making field 'java.lang.ref.Reference#referent' accessible)

オープン
  • 何か問題がありますか？
#466 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
48/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
android, kotlin
領域
build-system

調査の方向性

Start by inspecting the plugin's dependency declarations and the buildEnvironment differences between versions 0.10.10 and 0.13.0. Use the minimal externalNativeBuild reproduction and the testapp verification suite, noting that testapp currently lacks an externalNativeBuild module. Done means configureCMakeDebug succeeds on JDK 17+ without forcing protobuf-java 4.x onto AGP's classpath.

索引モデルが issue の本文から書いたものです。

説明

Summary

oss-licenses-plugin 0.11.0 and later (0.11.0 / 0.12.0 / 0.13.0 all affected; 0.10.10 is fine) breaks every configureCMake* task in projects that use externalNativeBuild, when the Gradle daemon runs on JDK 17+ (mandatory with current AGP):

Execution failed for task ':app:configureCMakeDebug[arm64-v8a]'.
> Failed making field 'java.lang.ref.Reference#referent' accessible; either increase
  its visibility or write a custom TypeAdapter for its declaring type.
  See https://github.com/google/gson/blob/main/Troubleshooting.md#reflection-inaccessible
...
Caused by: java.lang.reflect.InaccessibleObjectException: Unable to make field private
  java.lang.Object java.lang.ref.Reference.referent accessible: module java.base does
  not "opens java.lang.ref" to unnamed module
	at com.google.gson.internal.reflect.ReflectionHelper.makeAccessible(ReflectionHelper.java:68)
	...
	at com.android.build.gradle.internal.cxx.logging.PassThroughRecordingLoggingEnvironmentKt.toJsonString(PassThroughRecordingLoggingEnvironment.kt:107)
	at com.android.build.gradle.tasks.ExternalNativeJsonGenerator.configureOneAbi(ExternalNativeJsonGenerator.kt:341)
Root cause

The plugin (since 0.11.0) depends on com.google.protobuf:protobuf-java:4.x (4.35.1 via 0.13.0). Gradle's highest-version conflict resolution upgrades the whole build classpath away from the 3.25.5 that AGP is built against:

# buildEnvironment, AGP 8.13.2 alone:        protobuf-java:3.25.5
# with oss-licenses-plugin 0.13.0 applied:   protobuf-java:4.35.1  (3.19.3/3.22.3/3.24.4/3.25.5 -> 4.35.1)

AGP's native-configure structured logging Gson-serializes a protobuf message reflectively; under the protobuf-4 runtime that object graph reaches a java.lang.ref.Reference, which JDK 17 module encapsulation forbids reflecting into.

Verified in both directions with a minimal project (AGP 8.13.2 + one dummy CMake library + this plugin, nothing else):

configuration result
plugin 0.10.10 OK
plugin 0.11.0 / 0.12.0 / 0.13.0 FAILED as above
plugin 0.13.0 + strictly("com.google.protobuf:protobuf-java:3.25.5") buildscript constraint OK
no plugin OK

Gson (2.11.0) and all com.android.tools artifact versions are identical with and without the plugin — protobuf-java is the only relevant classpath change.

Environment
  • oss-licenses-plugin 0.13.0 (also 0.12.0, 0.11.0) — 0.10.10 OK
  • AGP 8.13.2, Gradle 9.0.0, daemon JDK 17 (temurin/openjdk), launcher JDK 21
  • Any externalNativeBuild { cmake { ... } } module; Linux x86_64
Steps to reproduce
  1. New single-module app project, AGP 8.13.2, add a minimal externalNativeBuild CMake library (one dummy .cpp).
  2. Apply com.google.android.gms.oss-licenses-plugin version 0.13.0.
  3. ./gradlew :app:configureCMakeDebug
Suggested fix

Don't force a protobuf-java major-version upgrade onto the shared buildscript classpath that AGP runs on — depend on protobuf-java 3.25.x, shade it, or mark the 4.x need as a compileOnly/isolated detail. (Note: the testapp verification suite has no externalNativeBuild module, which is likely why CI doesn't catch this.)

Workarounds for affected users
  • Pin the plugin to 0.10.10, or
  • keep the latest plugin and add a buildscript dependency constraint: com.google.protobuf:protobuf-java strictly("3.25.5").

A secondary hardening opportunity exists on the AGP side (reflective Gson over protobuf runtime internals in PassThroughRecordingLoggingEnvironment rather than protobuf's own serializer); happy to cross-file there if useful.

主要言語
Kotlin
スター
526
フォーク
170
平均マージ
1日 7時間
マージ済み PR（30日）
3

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

google/play-services-plugins のほかの issue

google/play-services-plugins の issue をすべて見る

似ている issue

Kotlin の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。