Transitive bazel dependencies have public visibility about rules_jvm_external HOT 3 CLOSED

Yes, we should definitely restrict the visibility of unspecified artifacts. I'll mark this as a good first issue for anyone to take up if they want to give it a shot.

from rules_jvm_external.

This seems like a good idea in principle, but there are unfortunately some dependencies that seem to be specifically set up to bring in dependencies for you to directly reference. The Spring Boot starters would be a good example. It seems like a bad practice to me, but they get used pretty heavily. :( So, even if this gets done, I think there should be an option to turn it off.

from rules_jvm_external.

So, even if this gets done, I think there should be an option to turn it off.

I agree. It's also possible for the rule, or use bazel query, to provide the flat list of artifacts that are actually used, so it's simple to switch to this behavior.

from rules_jvm_external.