Messaging fails build with latest 29.2.0 release, 29.1.0 is fine [solved, 29.2.1 works]

[READ] Step 1: Are you in the right place?

This is the right place

[REQUIRED] Step 2: Describe your environment

• Android Studio version: current stable, also not relevant for this issue
• Firebase Component: Messaging
• Component version: BoM 29.2.0, Messaging is 23.0.1

[REQUIRED] Step 3: Describe the problem

For some reason the messaging component in BoM 29.2.0 leaks in httpcomponents transitive dependencies which have an APK packaging issue with regard to multiple META-INF/DEPENDENCIES files. It looks like it has been a known issue historically as there is an attempt in your build.gradle to exclude them. For some reason that isn’t working on 29.2.0, even though it works on 29.1.0 (you can switch between the two BoMs in your messaging quickstart to witness success v failure)

Steps to reproduce:

This is me showing you the reproduction using your quickstart-android repository, cloned just now with a visible diff so you can see the changes required to reproduce:

mike@osxvm-spare:~/work/Invertase/quickstart-android/messaging (master *) % ./gradlew assembleDebug
> Task :app:mergeDebugJavaResource FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':app:mergeDebugJavaResource'.
> A failure occurred while executing com.android.build.gradle.internal.tasks.MergeJavaResWorkAction
   > 2 files found with path 'META-INF/DEPENDENCIES' from inputs:
      - /Users/mike/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.5.11/f6d42fee5110c227bac18a550a297e028f2fb21a/httpclient-4.5.11.jar
      - /Users/mike/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpcore/4.4.13/853b96d3afbb7bf8cc303fe27ee96836a10c1834/httpcore-4.4.13.jar
     Adding a packagingOptions block may help, please refer to
     https://google.github.io/android-gradle-dsl/current/com.android.build.gradle.internal.dsl.PackagingOptions.html
     for more information

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

* Get more help at https://help.gradle.org

BUILD FAILED in 28s
81 actionable tasks: 12 executed, 69 up-to-date
mike@osxvm-spare:~/work/Invertase/quickstart-android/messaging (master *) % git diff
diff --git a/messaging/app/build.gradle b/messaging/app/build.gradle
index 02fc3ef3..539dd098 100644
--- a/messaging/app/build.gradle
+++ b/messaging/app/build.gradle
@@ -11,7 +11,7 @@ android {
 
     defaultConfig {
         applicationId "com.google.firebase.quickstart.fcm"
-        minSdkVersion 16
+        minSdkVersion 19
         targetSdkVersion 30
         versionCode 1
         versionName "1.0"
@@ -50,7 +50,7 @@ dependencies {
     implementation 'com.google.android.material:material:1.4.0'
 
     // Import the Firebase BoM (see: https://firebase.google.com/docs/android/learn-more#bom)
-    implementation platform('com.google.firebase:firebase-bom:28.3.0')
+    implementation platform('com.google.firebase:firebase-bom:29.2.0')
 
     // Firebase Cloud Messaging (Java)
     implementation 'com.google.firebase:firebase-messaging'
diff --git a/messaging/gradle.properties b/messaging/gradle.properties
index aac7c9b4..c7fb972d 100644
--- a/messaging/gradle.properties
+++ b/messaging/gradle.properties
@@ -15,3 +15,5 @@ org.gradle.jvmargs=-Xmx1536m
 # This option should only be used with decoupled projects. More details, visit
 # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
 # org.gradle.parallel=true
+
+android.useAndroidX=true
\ No newline at end of file

Relevant Code:

Your quickstart helpfully provides the relevant code to reproduce, see above.

It’s very strange to me that this dependency is creeping in. I did ./gradlew :app:dependencies on BoM 29.1.0 and 29.2.0 and diffed them, and sure enough it comes in on 29.2.0 only, here’s a relevant chunk of that diff:

5337,5343c5407,5436
< |         +--- com.google.android.datatransport:transport-backend-cct:3.0.0 -> 3.1.2 (*)
< |         +--- com.google.android.datatransport:transport-runtime:3.0.0 -> 3.1.2 (*)
< |         +--- com.google.android.gms:play-services-basement:17.0.0 -> 18.0.0 (*)
< |         +--- com.google.android.gms:play-services-cloud-messaging:17.0.0 (*)
< |         +--- com.google.android.gms:play-services-stats:17.0.0 -> 17.0.2 (*)
< |         +--- com.google.android.gms:play-services-tasks:17.0.0 -> 18.0.1 (*)
< |         +--- com.google.firebase:firebase-common:20.0.0 (*)
---
> |         +--- com.google.android.datatransport:transport-backend-cct:3.1.2 (*)
> |         +--- com.google.android.datatransport:transport-runtime:3.1.2 (*)
> |         +--- com.google.android.gms:play-services-base:18.0.1 (*)
> |         +--- com.google.android.gms:play-services-basement:18.0.0 (*)
> |         +--- com.google.android.gms:play-services-cloud-messaging:17.0.1 (*)
> |         +--- com.google.android.gms:play-services-stats:17.0.2 (*)
> |         +--- com.google.android.gms:play-services-tasks:18.0.1 (*)
> |         +--- com.google.api-client:google-api-client:1.30.9
> |         |    +--- com.google.oauth-client:google-oauth-client:1.30.5
> |         |    |    +--- com.google.http-client:google-http-client:1.34.0 -> 1.34.2
> |         |    |    |    +--- org.apache.httpcomponents:httpclient:4.5.11
> |         |    |    |    |    +--- org.apache.httpcomponents:httpcore:4.4.13

Adding: exclude 'META-INF/DEPENDENCIES'

to packagingOptions in build.gradle works around the issue, but it’s a regression causing a build failure on update from BoM 29.1.0 to 29.2.0. What changed 🤔

[argzdev]

Hi @mikehardy, thanks for reporting. I was able to reproduce the same issue, I’ll notify an engineer to see what we can do here.

[carlonzo]

FYI here are the new dependencies that have been added with this BoM, which adds 2MB of dex in our APK.

New Dependencies
com.fasterxml.jackson.core:jackson-core:2.10.2
com.google.api-client:google-api-client:1.30.9
com.google.code.findbugs:jsr305:3.0.2
com.google.errorprone:error_prone_annotations:2.3.4
com.google.guava:failureaccess:1.0.1
com.google.guava:guava:28.2-android
com.google.http-client:google-http-client:1.34.2
com.google.http-client:google-http-client-jackson2:1.34.2
com.google.j2objc:j2objc-annotations:1.3
com.google.oauth-client:google-oauth-client:1.30.5
commons-codec:commons-codec:1.11
commons-logging:commons-logging:1.2
io.grpc:grpc-context:1.22.1
io.opencensus:opencensus-api:0.24.0
io.opencensus:opencensus-contrib-http-util:0.24.0
org.apache.httpcomponents:httpclient:4.5.11
org.apache.httpcomponents:httpcore:4.4.13
org.checkerframework:checker-compat-qual:2.5.5