Optional dependencies are automatically included

[connesc]

trafficstars

When a library declares optional dependencies, they are automatically included in the resulting fat JAR. I guess this is not the expected behavior.

A good example is elasticsearch-spark-20 (elasticsearch-spark-20_2.11-5.5.2.pom), which declares some Spark dependencies: the provided one is properly ignored, but the optional ones are not.

For now, a possible workaround is to explicitly exclude them:

"org.elasticsearch" %% "elasticsearch-spark-20" % "5.5.2" excludeAll ExclusionRule(organization = "org.apache.spark")

[bes1002t]

was there any progress since 2017? I think from a security point of view it is always a good idea of using as less dependencies as possible. Which means optional dependencies should be excluded by default.

[eed3si9n]

Could someone check if this still happens with the latest sbt 1.5.6?

In general sbt-assembly grabs whatever in the runtime classpath of sbt, so if there's a problem the the resolved JARs it's a problem with sbt and specifically in this case an issue with dependency management engine like Coursier or Apache Ivy.