proper dependency resolution

[icegood]

hello. i have very basic android-based project with supposed dependencies:

`
###############################################################################

Bazel + Bzlmod external dependencies

###############################################################################

bazel_dep(name = "rules_android", version = "0.6.6")
remote_android_extensions = use_extension(
"@rules_android//bzlmod_extensions:android_extensions.bzl",
"remote_android_tools_extensions")
use_repo(remote_android_extensions, "android_tools")

bazel_dep(name = "rules_kotlin", version = "2.2.0")
kotlin_extensions = use_extension(
"@rules_kotlin//kotlin/bzlmod:kotlin.bzl",
"kotlin_extensions"
)

kotlin_extensions.toolchain(
kotlinc_version = "2.0.21",
)
use_repo(kotlin_extensions, "kotlin_tools")

android_sdk_repository_extension = use_extension(
"@rules_android//rules/android_sdk_repository:rule.bzl",
"android_sdk_repository_extension"
)
use_repo(android_sdk_repository_extension, "androidsdk")
register_toolchains("@androidsdk//:sdk-toolchain", "@androidsdk//:all")

----------------------------------------------------------------------

Maven dependencies (rules_jvm_external)

----------------------------------------------------------------------

bazel_dep(name = "rules_jvm_external", version = "6.9")
maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")

maven.install(
artifacts = [
"androidx.core:core-ktx:1.13.1",
"androidx.lifecycle:lifecycle-runtime-ktx:2.8.6",
"androidx.activity:activity-compose:1.9.2",

    # UI + Material, no versions (BOM controls everything)
    "androidx.compose.ui:ui",
    "androidx.compose.ui:ui-graphics",
    "androidx.compose.ui:ui-tooling-preview",
    "androidx.compose.material3:material3",

    #
    # Unit tests
    #
    "junit:junit:4.13.2",

    #
    # Android tests
    #
    "androidx.test.ext:junit:1.3.0",
    "androidx.test.espresso:espresso-core:3.7.0",

    # Compose testing (no version)
    "androidx.compose.ui:ui-test-junit4",

    #
    # Debug tooling
    #
    "androidx.compose.ui:ui-tooling",
    "androidx.compose.ui:ui-test-manifest",
],
boms = [
    "androidx.compose:compose-bom:2024.09.00",
],
repositories = [
    "https://maven.google.com",
    "https://repo1.maven.org/maven2",
],

)`

and obtained error (see link)
https://drive.google.com/file/d/1z3h51OB4ZB5SPYs0sD0B_3Vx8cEkBrNH/view?usp=sharing

Seems, the problem of creating of consisntent set of libraries is up to user. What user should do to find proper version of
androidx.collection:collection:1.0.0 or 1.1.0 or 1.4.0 or [1.2.0] wanted by

BOMs doesnt work as not all libraries are under boms.

[icegood]

found a way to do
version_conflict_policy = "pinned"
which means that theoretically library misversion hell remains but makes it more controllable just because of user awareness.
Ideal sulution would be to demand from library producers any types of BOMes, that somehow package managers in different oses alrready do. Therefore, making other build systems, that rely on PMs, more preferable in sense of control... E.g. cmake