Quarkus enforcedplatform BOM in build.gradle.kts breaks added dependency

I have added a dependecny implementation("com.netflix.conductor:conductor-client:3.13.8")
for my quarkus project. However enforcedPlatform("${quarkusPlatformGroupId}:${quarkusPlatformArtifactId}:${quarkusPlatformVersion}") breaks transitive dependency of conductor-client. I looked at gradle documentation, They suggest to use exclude but exclude did not work in my case

Build Gradle File:

plugins {
kotlin("jvm") version "1.8.22"
kotlin("plugin.allopen") version "1.8.22"
id("io.quarkus")
}
repositories {
mavenCentral()
mavenLocal()
}
val quarkusPlatformGroupId: String by project
val quarkusPlatformArtifactId: String by project
val quarkusPlatformVersion: String by project
val ktor_version: String by project
dependencies {
implementation(enforcedPlatform("${quarkusPlatformGroupId}:${quarkusPlatformArtifactId}:${quarkusPlatformVersion}"))
implementation("io.quarkus:quarkus-picocli")
implementation("io.quarkus:quarkus-kotlin")
implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
implementation("io.quarkus:quarkus-arc")
implementation("io.ktor:ktor-client-cio-jvm:2.3.3")
testImplementation("io.quarkus:quarkus-junit5")
implementation("io.ktor:ktor-client-core:$ktor_version")
implementation("io.ktor:ktor-client-cio:$ktor_version")
// https://mvnrepository.com/artifact/com.netflix.conductor/conductor-client
implementation("com.netflix.conductor:conductor-client:3.13.8")
}
group = "io.my1795"
version = "1.0.0-SNAPSHOT"
java {
sourceCompatibility = JavaVersion.VERSION_17
targetCompatibility = JavaVersion.VERSION_17
}
tasks.withType<Test> {
systemProperty("java.util.logging.manager", "org.jboss.logmanager.LogManager")
}
allOpen {
annotation("jakarta.ws.rs.Path")
annotation("jakarta.enterprise.context.ApplicationScoped")
annotation("io.quarkus.test.junit.QuarkusTest")
}
tasks.withType<org.jetbrains.kotlin.gradle.tasks.KotlinCompile> {
kotlinOptions.jvmTarget = JavaVersion.VERSION_17.toString()
kotlinOptions.javaParameters = true
}

Failure after quarkusBuild

11:29:08 AM: Executing 'quarkusBuild'...

> Task :processResources UP-TO-DATE
> Task :quarkusGenerateCode FAILED

Deprecated Gradle features were used in this build, making it incompatible with Gradle 9.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

See https://docs.gradle.org/8.1.1/userguide/command_line_interface.html#sec:command_line_warnings
2 actionable tasks: 1 executed, 1 up-to-date

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':quarkusGenerateCode'.
> Could not resolve all files for configuration ':quarkusProdBaseRuntimeClasspathConfiguration'.
   > Could not resolve org.apache.logging.log4j:log4j-api:2.20.0.
     Required by:
         project : > io.quarkus.platform:quarkus-bom:3.2.3.Final
      > Cannot find a version of 'org.apache.logging.log4j:log4j-api' that satisfies the version constraints:
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-api:{strictly 2.17.2}'
           Constraint path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'io.quarkus.platform:quarkus-bom:3.2.3.Final' (enforced-platform-runtime) --> 'org.apache.logging.log4j:log4j-api:2.20.0'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-core:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-slf4j-impl:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-jul:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-web:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'com.netflix.conductor:conductor-common:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-api:{strictly 2.17.2}'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'com.netflix.conductor:conductor-common:3.13.8' (runtimeElements) --> 'com.netflix.conductor:conductor-annotations:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-api:{strictly 2.17.2}'

   > Could not resolve org.apache.logging.log4j:log4j-api:{strictly 2.17.2}.
     Required by:
         project : > com.netflix.conductor:conductor-client:3.13.8
         project : > com.netflix.conductor:conductor-client:3.13.8 > com.netflix.conductor:conductor-common:3.13.8
         project : > com.netflix.conductor:conductor-client:3.13.8 > com.netflix.conductor:conductor-common:3.13.8 > com.netflix.conductor:conductor-annotations:3.13.8
      > Cannot find a version of 'org.apache.logging.log4j:log4j-api' that satisfies the version constraints:
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-api:{strictly 2.17.2}'
           Constraint path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'io.quarkus.platform:quarkus-bom:3.2.3.Final' (enforced-platform-runtime) --> 'org.apache.logging.log4j:log4j-api:2.20.0'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-core:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-slf4j-impl:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-jul:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-web:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'com.netflix.conductor:conductor-common:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-api:{strictly 2.17.2}'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'com.netflix.conductor:conductor-common:3.13.8' (runtimeElements) --> 'com.netflix.conductor:conductor-annotations:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-api:{strictly 2.17.2}'

   > Could not resolve org.apache.logging.log4j:log4j-api:2.17.2.
     Required by:
         project : > com.netflix.conductor:conductor-client:3.13.8 > org.apache.logging.log4j:log4j-core:2.17.2
         project : > com.netflix.conductor:conductor-client:3.13.8 > org.apache.logging.log4j:log4j-slf4j-impl:2.17.2
         project : > com.netflix.conductor:conductor-client:3.13.8 > org.apache.logging.log4j:log4j-jul:2.17.2
         project : > com.netflix.conductor:conductor-client:3.13.8 > org.apache.logging.log4j:log4j-web:2.17.2
      > Cannot find a version of 'org.apache.logging.log4j:log4j-api' that satisfies the version constraints:
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-api:{strictly 2.17.2}'
           Constraint path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'io.quarkus.platform:quarkus-bom:3.2.3.Final' (enforced-platform-runtime) --> 'org.apache.logging.log4j:log4j-api:2.20.0'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-core:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-slf4j-impl:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-jul:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-web:2.17.2' (runtime) --> 'org.apache.logging.log4j:log4j-api:2.17.2'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'com.netflix.conductor:conductor-common:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-api:{strictly 2.17.2}'
           Dependency path 'io.my1795:conductor-commander:1.0.0-SNAPSHOT' --> 'com.netflix.conductor:conductor-client:3.13.8' (runtimeElements) --> 'com.netflix.conductor:conductor-common:3.13.8' (runtimeElements) --> 'com.netflix.conductor:conductor-annotations:3.13.8' (runtimeElements) --> 'org.apache.logging.log4j:log4j-api:{strictly 2.17.2}'


* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.

* Get more help at https://help.gradle.org

BUILD FAILED in 370ms
11:29:08 AM: Execution finished 'quarkusBuild'.

I would say that is a bug in conductor.

A library should usually never strictly depend on some concrete version or you get problems like this where the library strictly requires a version and some build or other library strictly depends on some other version which then cannot be resolved.

In your case you add the second strict version by using enforcedPlatform which adds strict constraints and should usually also not be used. It is more for rare edge cases and usually just platform should be used.

But besides that, if you look at https://github.com/Netflix/conductor/blob/v3.13.8/build.gradle#L108-L116 it seems that the strict boundary should allow any version between 2.17.2 and 3.0, but some other part of the build seems to change this to strictly only 2.17.2.

Besides that the whole block except for log4j-core is very questionable. It is most probably to protect against Log4Shell, which anyway only affects log4j-core, so having all theses for the other log4j dependencies is pointless anyway and just slows down dependency resolution potentially.

But indeed an exclude should work to ad-hoc solve your problem. You said it didn't work, but but did not say where and how you tried it. You could for example exclude it from the conductor-client dependency and then depend manually on it if no other part depends on it and conductor-client needs it.