title: Gradle is selecting wrong dependency version
body: <p>I am seeing some weirdness in my Gradle build. I have a Spring Boot app (which uses Gradle for its build) and am trying to pull in both the Hibernate Validator as well as Hibernate Core. Here's the <code>dependencies</code> declaration in my <code>build.gradle</code> file:</p>
  
  <pre><code>dependencies {
      compile('org.springframework.boot:spring-boot-starter-web') {
          exclude module: 'spring-boot-starter-tomcat'
      }
  
      compile(
          'org.codehaus.groovy:groovy-all:2.4.12'
          ,'com.google.inject:guice:4.1.0'
          ,'ch.qos.logback:logback-classic:1.2.3'
          ,'org.slf4j:jul-to-slf4j:1.7.25'
          ,'org.apache.logging.log4j:log4j-to-slf4j:2.9.1'
          ,'commons-cli:commons-cli:1.4'
          ,'org.apache.commons:commons-lang3:3.7'
          ,'io.dropwizard.metrics:metrics-core:3.2.5'
          ,'io.dropwizard.metrics:metrics-json:3.2.5'
          ,'org.springframework.security:spring-security-jwt:1.0.9.RELEASE'
          ,'org.springframework.security.oauth:spring-security-oauth2:2.2.1.RELEASE'
          ,'io.jsonwebtoken:jjwt:0.9.0'
          ,'org.hibernate:hibernate-validator:6.0.7.Final'
          ,'mysql:mysql-connector-java:6.0.6'
          ,'org.hibernate:hibernate-core:5.2.12.Final'
  
          ,'com.h2database:h2:1.4.196'
  
          ,'org.springframework.boot:spring-boot-starter-jetty'
          ,'org.springframework.boot:spring-boot-starter-actuator'
          ,'org.springframework.boot:spring-boot-starter-security'
          ,'org.springframework.boot:spring-boot-starter-data-rest'
          ,'org.springframework.boot:spring-boot-starter-data-jpa'
      )
  
      dev('org.springframework.boot:spring-boot-devtools')
  
      testCompile(
          'org.spockframework:spock-core:1.0-groovy-2.4'
          ,'junit:junit:4.12'
      )
  }
  </code></pre>
  
  <p>When I run <code>./gradlew dependencies</code> I get a huge output, but from the <code>compile</code> dependencies tree I see the following:</p>
  
  <pre><code>|    +--- org.springframework.boot:spring-boot-starter:1.5.8.RELEASE
  |    +--- org.hibernate:hibernate-validator:5.3.5.Final -&gt; 6.0.7.Final
  |    |    \--- org.hibernate.validator:hibernate-validator:6.0.7.Final
  |    |         +--- javax.validation:validation-api:2.0.1.Final -&gt; 1.1.0.Final
  |    |         +--- org.jboss.logging:jboss-logging:3.3.0.Final -&gt; 3.3.1.Final
  |    |         \--- com.fasterxml:classmate:1.3.1 -&gt; 1.3.4
  </code></pre>
  
  <p>So to me it looks like <code>spring-boot-starter:1.5.8.RELEASE</code> is pulling in <code>validation-api:2.0.1.Final</code> but for some reason Gradle is selecting <code>validation-api:1.1.0.Final</code> for me...am I reading that correctly? In my IDE compile classpath I only see <code>validation-api:1.1.0.Final</code>, not <code>2.0.1.Final</code>.</p>
  
  <p><strong>Why is Gradle selecting <code>1.1.0.Final</code> instead of <code>2.0.1.Final</code>?</strong> I ask because Hibernate Validator 5.x <a href="https://stackoverflow.com/a/24652819/4009451">is not compatible with Validation API 1.x</a> and when my app runs I get all sorts of Hibernate Validation-related errors.</p>
  
  <h2>Update</h2>
  
  <p>Some more output:</p>
  
  <pre><code>gradle -q dependencyInsight --configuration compile --dependency validation-api
  javax.validation:validation-api:1.1.0.Final (selected by rule)
  
  javax.validation:validation-api:2.0.1.Final -&gt; 1.1.0.Final
  \--- org.hibernate.validator:hibernate-validator:6.0.7.Final
       \--- org.hibernate:hibernate-validator:6.0.7.Final
            +--- compile
            \--- org.springframework.boot:spring-boot-starter-web:1.5.8.RELEASE
                 +--- compile
                 \--- org.springframework.boot:spring-boot-starter-data-rest:1.5.8.RELEASE
                      \--- compile
  </code></pre>
  
  <p>The full compile configuration output <a href="https://pastebin.com/CQLY3tDp" rel="nofollow noreferrer">can be found here</a>.</p>