Play Framework

feat(gradle-plugin): warn when a dependency asks for a newer version of a library framework/lib ships (PF-194)

PF-192 excludes every library in lib-coordinates.properties from the
application's graph, and the version a dependency asked for went with
the excluded edge. A dependency built against a newer Jackson, OkHttp or
commons-codec than the fork ships then runs on the fork's older copy and
fails at run time with NoSuchMethodError or NoClassDefFoundError, while
the build stays green and says nothing.

alignWithFrameworkLib now resolves the graph of the same declarations
without the excludes, metadata only, in a detached configuration carrying
runtimeClasspath's attributes, and warns once per library that a
dependency asks for above the framework/lib version, or through a range
that version is outside of, naming the library, each requester with the
version it asks for, and the fork's version. Left out are constraint
edges, the application's own declarations (the "has no effect" warning
covers those), libraries in appManagedLibraries, and requests from a
library framework/lib replaces or from anything only such a library
brings in, since none of them reach the classpaths. A managed library's
own requests are checked, because its jar does reach them. Versions are
compared by GradleVersionOrder, Gradle's documented ordering, for want
of a public comparator. A failure to resolve that graph warns and never
fails a build.

Gradle drops warnings under -q, so play1 { failOnNewerLibraryRequests =
true }, or -PfailOnNewerLibraryRequests, which wins for one build, turns
them into a build failure.

On jclaw with commons-codec 1.22.0 it prints exactly one warning: five
Tika 4.1.0 parsers ask for 1.22.1. With 1.23.0 (merged from Renovate) it
prints none. Configuring stays within the configuration cache. Guarded
by NewerLibraryRequestTest (TestKit, including a configuration-cache run)
and GradleVersionOrderTest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>