cheister

Adding it as a dependency in the JSON report also works for me.

Currently the targets for `exe` artifacts are only generated if you specify a lock_file for the maven.install. If you specify a lock_file and repin you should be able to run...

Commenting to reset stale check, This is still an issue.

There is already the [duplicate_version_warning](https://github.com/bazelbuild/rules_jvm_external?tab=readme-ov-file#duplicate-artifact-warning) option to maven install to warn about duplicate artifact declarations. I think overriding versions from BOM files is different though and probably not a warning....

All of the rules_jvm_external code uses $HOME, it looks like coursier itself may not using be $HOME when it is creating the file paths for the artifacts though, possibly because...

> Perhaps it could prefer the root module’s version if specified? I believe this is how it works. Can you provide and example of something that isn't working as you...

Just noting, snapshot artifacts will never work for maven_installs that use a lockfile since the version (0.3.0-20240503.081128-2) and SHA of the snapshot jar can change without changing the artifact version...

https://github.com/bazel-contrib/rules_jvm_external/pull/1378 should fix this

Looking at `com.github.ben-manes.caffeine:caffeine:2.9.3` from https://repo1.maven.org/maven2/com/github/ben-manes/caffeine/caffeine/2.9.3/caffeine-2.9.3.jar, the shasum is `1e0a7bbef1dd791653143f3f05d0e489934bf5481e58a87c9e619cd46b68729b` Do you have this artifact in a different repo with a different shasum for the same version?

There are two things to check: - We still support Java 11 where "-noverify" is a valid option - The comment above the line you listed has the comment ```...