tree 5357aae366dc9d2c486876659d791f4bc5ea81ca
parent aed3a989e6b0300345c07b9e18d3298a0a56b377
author Simon Mavi Stewart <simon.m.stewart@gmail.com> 1768131755 +0000
committer GitHub <noreply@github.com> 1768131755 +0000
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJpY4yrCRC1aQ7uu5UhlAAAxOIQAAmFf15rIzRSu+yUFHEirTGp
 L0KbGvrs6x0GNPIIoIKYylSV73UUXg96m9MUc5UF3NErWAEo6kUntarXwXdbAh0u
 iMnFeD/afXg0XSX4tEBGQcO4eHS/4m8w8kUbrceUpPWmO4kxUgBFh4Esi9C/tO1E
 /QU19IQ7PdauPp5S9xBhHok4twcv1a0W3BDEJKs9yPSWKhk+VY9I/LXINlCqs88Q
 GZve6TQsCBhQqWENtzH4mNUzNE5jbv+49XpsV0rKXrSk0PPlG3psON+sZ5IgiDNm
 XHYLPPOqcJ1XuynXYn829iqcOY7Kw3HGhERvrxFUiAm0G/X60rKzq13mWFN0W86e
 WI+D1JrQxx9Lh958o+cuxzVjmmQzKpSoJ+4INNgiKJ8i9u3rNyZCTRZoY4791nn4
 u50Zc75qav6aWIpUQuEKWS4pMwjjC9H0cRDHbXK2GlKshEBobxytH6Twfy95Te0+
 oESSxUwz45Teq0HDV2YNbfkyU0iSYuiHELSvAQtx2szqZ7wo5yp3MHrpkmNU+96K
 20JC4JVARqi777RFaxq0KRb5SZmAowuFbGVYcP+idA/uLUCKvNAUFIiZMNFn/5nZ
 jIzlsy7tY/QxhICcEhZgXqcqmmlgy4DoF1qVUmZyGyv7+pyPKEzDb2+4kOGnDnRU
 MXX0mbUNRd+28J02Rygo
 =yFsO
 -----END PGP SIGNATURE-----
 

Fix SHA mismatch for conflicting dependency versions (#1513)

When Gradle resolved version conflicts, the paths map included both the
resolved version and the conflicting lower version. This caused the
lockfile to record the SHA from the wrong version file, leading to
checksum validation failures.

For example, when resolving j2objc-annotations 2.8 → 3.0.0, the lockfile
would store version "3.0.0" but the SHA from the 2.8 JAR file.

Changes:
- Populate paths for all nodes in the final dependency graph, not just
  root dependencies
- Filter paths map to only include coordinates present in the final
  resolved graph, automatically excluding conflicting versions,
  relocated artifacts, and aggregating dependencies
- Move test to GradleResolverTest since behavior differs between resolvers

Amp-Thread-ID: https://ampcode.com/threads/T-019ba31f-0683-719f-9ce1-41dbd15e69f5

Co-authored-by: Amp <amp@ampcode.com>