compileOnly and implementation dependencies

[Kostas Kalevras]

Hello team

We are using the sso-cas-overlay template along with our own code for building CAS with multiple features enabled (JPA, LDAP, GAuth, OIDC, SAML, REST protocols etc).

Does anyone have a guide on how to determine which dependencies must be added as implementation and which can be declared as only compileOnly? Obviously those that are included in the documentation for enabling a feature have already been declared as implementation but we are having a bit of a hard time with cas-server-core-* and *-api dependencies (with a few required to be added in build.gradle in order for our code to build)

We have already run gradlew dependencies --configuration runtimeClasspath and gradlew dependencies --configuration compileClasspath but it's not extremely helpful.

Any help will be appreciated

[Daniel Ellentuck]

Hi Kostas,

I've found it helpful to use an LLM to answer this kind of question.  In a similar situation, I used Googe's Gemini with the specific dependency questions as prompts and the gradle dependencies report as input. I had to break up the dependency graph but I was able to get my answers fairly quickly.

Dan Ellentuck

Columbia University I.T.

On Mon, Jul 7, 2025 at 4:14 AM Kostas Kalevras <kka...@gmail.com> wrote:

Hello team We are using the sso-cas-overlay template along with our own code for building CAS with multiple features enabled (JPA, LDAP, GAuth, OIDC, SAML, REST protocols etc). Does anyone have a guide on how to determine which dependencies

ZjQcmQRYFpfptBannerStart

This Message Is From an External Sender

This message came from outside your organization.

 

ZjQcmQRYFpfptBannerEnd

--
- Website: https://apereo.github.io/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/b1bc1ca7-b634-4618-8f4c-11e1ac620cd7n%40apereo.org.

[Ray Bon]

Kostas,

More old school than an LLM; take the unmet dependency class and search the Cas code base for the file (on github or a clone of the project).

Ray

---

From: cas-...@apereo.org <cas-...@apereo.org> on behalf of Kostas Kalevras <kka...@gmail.com>
Sent: July 7, 2025 01:00
To: CAS Community <cas-...@apereo.org>
Subject: [cas-user] compileOnly and implementation dependencies

 

--

[Petr Bodnár]

Hi Kostas,

interesting question. This seems to be more of a Gradle than CAS question, even though CAS seems to use "compileOnly" scope quite extensively for a reason I would also like to understand. Anyway, I think you can't go wrong with using "implementation" scope for all regular dependencies that are needed also in runtime (or during unit tests) as well. They should be present in the resulting CAS war anyway. Whilst the "compileOnly" scope should be really used just for libraries like Lombok or libraries which will be supplied by your application server. Or at least this answer to Is it recommended to use compileOnly over implementation if another module use implementation says so. But the Gradle "world of scopes" is historically a pretty tricky thing...

Best regards

Petr