feat: support transitive dependencies in BGP (RNC-CLI path)

[KisaneNeko]

What this does

Adds experimentalIncludeTransitiveDependencies to the Brownfield Gradle Plugin.

A brownfield AAR bundles your native modules, but it doesn't tell the consuming app about the third party libraries those modules need, so today the host team has to declare them by hand. This makes BGP find them and write them into the published POM and Gradle Module Metadata, so Gradle resolves them on its own. Expo projects already worked this way, this brings the same thing to RNC CLI projects.

It's on by default.

Notion ticket: Brownfield: support transitive dependencies in BGP

What it means if you already use Brownfield

Your build keeps working, but the metadata you publish changes:

• Versions you pinned by hand can go up if an embedded module needs something newer. They never go down.
• Dependencies you never declared will show up in your POM.
• If you have the removeDependenciesFromModuleFile block from the old setup docs, you can keep it or delete it. It no longer clashes with the plugin.

Probably worth calling out in the changelog.

Bugs fixed along the way

Most of these came out of review.

• The plugin registered a task called removeDependenciesFromModuleFile, which is the same name our docs tell people to register themselves. The plugin applies first, so just bumping the version broke the build with a duplicate task error, and setting the flag to false didn't help. Renamed it to brownfieldRemoveDependenciesFromModuleFile.
• Discovery ran in afterEvaluate, which only waits for the current project to be configured. The embedded modules usually weren't ready yet, so it found nothing at all. Moved to taskGraph.whenReady.
• If your app declared something like androidx.core:core-ktx:1.+, that 1.+ could win and get published.
• A dependency declared without a version (BOM or platform()) ended up in the POM twice.
• Publishing a library that has no dependencies crashed.
• On the Expo side, appendExpoTransitiveDependenciesFromGradle looked for a configuration called runtime, but modern AGP calls it runtimeOnly, so it had been quietly skipping those since feat: expo config plugin #223.

One thing I left alone

Every dependency goes into every variant, so runtime only ones end up visible at compile time to Gradle consumers. The obvious fix is to skip runtime scoped deps for api variants, but that doesn't work. Gradle writes runtime for a plain implementation when it generates a POM, so on the Expo side 73 of 84 dependencies look runtime scoped, and filtering on that would drop react-android and appcompat for Expo consumers. It needs a different approach and its own PR. There's a comment in the code with the details.

Testing

Published RNApp and ExpoApp57 to maven local and read through the generated POM and module.json: new dependencies get added, embedded modules stay out, dynamic versions get filtered, nothing shows up twice, everything has a real version. Built AndroidApp against it and ran Detox for both vanilla and Expo.

There are 33 unit tests, which isn't really the pattern in this repo, but this code edits publishing metadata in ways that are easy to get subtly wrong and several of them cover actual bugs from the list above. For each fix I reverted it and checked that its test went red. One of them is a TestKit test that sets a project up the old way and reproduces the duplicate task error end to end.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

A critical compilation issue and unresolved dependency discovery and publication correctness issues remain.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds opt-in transitive dependency discovery and publication for vanilla Brownfield projects, shares publishing logic with Expo, and fixes Expo runtimeOnly fallback handling.

Changes:

• Adds RNC dependency discovery, filtering, mediation, and metadata injection.
• Enables the option in RNApp and removes the manual workaround.
• Adds tests, documentation, and CI coverage.

File summaries

File	Reviewed changes
gradle-plugins/react/brownfield/src/test/kotlin/com/callstack/react/brownfield/utils/ExtensionTest.kt	Tests the option default.
gradle-plugins/react/brownfield/src/test/kotlin/com/callstack/react/brownfield/shared/VersionMediatingDependencySetTest.kt	Tests dependency version mediation.
gradle-plugins/react/brownfield/src/test/kotlin/com/callstack/react/brownfield/shared/DependencyPublishabilityTest.kt	Tests dependency coordinate filtering.
gradle-plugins/react/brownfield/src/test/kotlin/com/callstack/react/brownfield/expo/ExpoPublishingHelperGradleFallbackTest.kt	Covers runtimeOnly discovery.
gradle-plugins/react/brownfield/src/test/kotlin/com/callstack/react/brownfield/artifacts/RncTransitiveDependencyDiscovererTest.kt	Tests RNC dependency discovery.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/utils/Extension.kt	Adds the opt-in configuration option.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/VersionMediatingDependencySet.kt	Provides shared dependency mediation.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/PublishingMetadataInjector.kt	Injects dependencies into publication metadata. Final note: moderate (2 votes)—the metadata path is publication-name specific.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/GradleDependencyCollector.kt	Collects Gradle dependencies. Final note: moderate (1 vote)—runtimeOnly is published as compile.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/DependencyPublishability.kt	Filters dependency versions. Final note: moderate (3 votes)—latest.* and Maven ranges are not rejected.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/DependencyInfo.kt	Defines shared dependency data.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/Constants.kt	Updates shared imports.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/plugin/RNBrownfieldPlugin.kt	Integrates discovery and metadata publishing. Final notes: critical (1 vote)—nullable captured var does not compile; moderate (1 vote)—embedded projects may not be evaluated; nit (1 vote)—Expo discovery runs twice.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/expo/utils/BrownfieldPublishingInfo.kt	Restores Expo publishing data.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/expo/ExpoPublishingHelper.kt	Uses shared collection and discovery logic.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/artifacts/RncTransitiveDependencyDiscoverer.kt	Discovers vanilla module dependencies. Final notes: moderate (1 vote)—embedded-project evaluation may race collection; moderate (1 vote)—same-coordinate dependencies can be skipped before mediation.
gradle-plugins/react/brownfield/gradle/libs.versions.toml	Adds JUnit dependency versions.
gradle-plugins/react/brownfield/build.gradle.kts	Configures unit testing.
docs/docs/docs/getting-started/android.mdx	Documents the new option. Final note: nit (1 vote)—the troubleshooting guide also needs updating.
apps/RNApp/android/BrownfieldLib/build.gradle.kts	Enables transitive publishing and removes the workaround.
.gitignore	Ignores internal artifacts.
.github/workflows/gradle-plugin-lint.yml	Runs Gradle plugin tests.
.github/workflows/ci.yml	Includes plugin changes in app builds.

Review details

Suppressed comments (6)

docs/docs/docs/getting-started/android.mdx:346

• The new opt-in is not reflected in docs/docs/docs/guides/troubleshooting.mdx, which still says bare React Native transitive dependencies are not auto-resolved and instructs users to hand-declare them. Update that guide so users are directed to includeTransitiveDependencies and the manual workaround is reserved for projects that intentionally leave the option disabled.

> **Transitive dependencies:** the task-registration block above strips embedded-module entries from the generated POM by hand. If you don't need your embedded modules' own third-party dependencies to be resolvable by the app consuming this AAR, that manual block is all you need — skip the rest of this note.
>
> If you *do* want that (e.g. your embedded native modules pull in AndroidX libraries the consuming app should get automatically via Maven), set `includeTransitiveDependencies = true` in this module's `reactBrownfield { }` block instead of hand-rolling the JSON-manipulation task above — the plugin now performs the equivalent removal *and* injects your modules' real dependencies for you:
>
> ```kotlin
> reactBrownfield {
>     includeTransitiveDependencies = true
> }

gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/artifacts/RncTransitiveDependencyDiscoverer.kt:43

• This filters only by group/artifact, so it drops an embedded module's higher requirement whenever BrownfieldLib already declares the same coordinate at a lower or dynamic version. For example, an existing appcompat:1.6.0 declaration causes a module's appcompat:1.7.1 to be discarded before VersionMediatingDependencySet can mediate it, leaving the published POM at 1.6.0 and allowing a consumer to resolve below the module's requirement. Compare versions here, or merge and replace the existing publication entry with the mediated version instead of skipping unconditionally.

            .filterNot { isAlreadyDeclaredByConsumer(it.groupId, it.artifactId) }
            .forEach { discovered.add(it) }

gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/artifacts/RncTransitiveDependencyDiscoverer.kt:43

• afterEvaluate only guarantees that the Brownfield project has finished evaluation; it does not wait for each autolinked moduleProject returned by findProject. If a native module is evaluated later in the multi-project build, its implementation/api declarations are still absent here and the dependency is silently omitted from the published metadata. Ensure the embedded projects are evaluated before collection (or defer discovery until their evaluation callbacks have run).

        collectPublishableGradleDependencies(moduleProject)
            .filterNot { isAlreadyDeclaredByConsumer(it.groupId, it.artifactId) }
            .forEach { discovered.add(it) }

gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/plugin/RNBrownfieldPlugin.kt:84

• ExpoPublishingHelper.configure() still calls discoverAllExpoTransitiveDependencies for logging, and this new callback calls the same discovery again. Expo builds therefore parse the same POMs/configurations twice during configuration, adding avoidable work and duplicating any discovery failures; cache the first result or remove one of the calls.

                val expoTransitiveDeps = expoPublishingHelper.discoverAllExpoTransitiveDependencies(expoProjects)

gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/plugin/RNBrownfieldPlugin.kt:90

• This discovery runs from afterEvaluate on the Brownfield library, but findProject does not evaluate the embedded module. If an autolinked module is evaluated later, its implementation/api/runtimeOnly declarations are still unpopulated here and the code silently publishes no dependencies for that module. Ensure the embedded projects are evaluated before collecting their configurations, or defer discovery until project evaluation is complete.

            if (extension.includeTransitiveDependencies) {
                val rncTransitiveDeps = RncTransitiveDependencyDiscoverer(project).discover(artifacts)
                Logging.log("Merged ${rncTransitiveDeps.size} transitive dependencies discovered by the RNC discoverer")

gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/GradleDependencyCollector.kt:34

• fromGradleDep hard-codes every discovered dependency to compile, so the newly supported runtimeOnly configuration is published in the POM as a compile dependency. That unnecessarily puts runtime-only libraries on the consuming app's compile classpath and changes their intended API visibility; preserve the configuration's runtime scope when constructing DependencyInfo.

    TRANSITIVE_DEPENDENCY_CONFIG_NAMES.forEach { configName ->
        val configuration = project.configurations.findByName(configName) ?: return@forEach

        configuration.dependencies.forEach { dependency ->
            if (dependency is DefaultProjectDependency) return@forEach
            val group = dependency.group ?: return@forEach

            val info = DependencyInfo.fromGradleDep(group, dependency.name, dependency.version)
            if (isPublishableCoordinate(info)) result.add(info)

• Files reviewed: 22/23 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[hurali97]

Great work with the PR 🚀 Left some comments, please also review the Copilot's comments.

[hurali97]

This register a task in afterEvaluate which in most cases is discouraged. From the implementation here, we can see that it reads a file and then applies operations. It also uses a doLast block to conduct this operation.

I believe this provides us structure and enough information to register this task with inputs in the configuration phase, so before/outside of afterEvaluate.

[hurali97]

Let's default to true and rename/mark this as experimental.

[KisaneNeko]

@hurali97 this was previously passing but false-positive. I've now removed the deps from demo app and implemented fixes. Since you suggested flipping the flag to true by default I also revisited the scenarios of bumping the library version without removing the dependencies and that led me to some more issues that are now addressed.

This has been through multiple back-and-forth AI reviews, and tests are more useful than they used to be in the first version of this PR - should be ready for human review.