Replace transitive dependency of Gradle plugin - gradle

Question

The axion-release Gradle plugin has a dependency on the unmaintained com.jcraft:jsch:0.1.55 lib. The com.github.mwiede:jsch fork is a drop-in replacement for jcraft jsch providing the same namespace. How can I replace the plugin's dependency?
This does not appear to work:
buildscript {
dependencies {
classpath('pl.allegro.tech.build:axion-release-plugin:1.14.2') {
exclude group: 'com.jcraft', module: 'jsch'
}
}
configurations.classpath {
resolutionStrategy {
force 'com.github.mwiede:jsch:0.2.4'
}
}
}
This will remove com.jcraft.jsch from the classpath but that does not replace it with the maintained lib:
buildscript {
configurations.classpath {
resolutionStrategy {
exclude group: 'com.jcraft', module: 'jsch'
}
}
}
This also does not work
buildscript {
dependencies {
classpath('pl.allegro.tech.build:axion-release-plugin:1.14.2') {
exclude group: 'com.jcraft', module: 'jsch'
}
classpath 'com.github.mwiede:jsch:0.2.4'
}

Answer 1

I have tried substitution
buildscript {
dependencies {
classpath "pl.allegro.tech.build:axion-release-plugin:1.14.2"
}
configurations.all {
resolutionStrategy.dependencySubstitution {
substitute module("com.jcraft:jsch") using module("com.github.mwiede:jsch:0.2.4") because "of https://stackoverflow.com/q/74355649/2290153"
}
}
}
and buildEnvironment gives:
classpath
\--- pl.allegro.tech.build:axion-release-plugin:1.14.2
+--- org.eclipse.jgit:org.eclipse.jgit:5.13.1.202206130422-r
| +--- com.googlecode.javaewah:JavaEWAH:1.1.13
| \--- org.slf4j:slf4j-api:1.7.30
+--- org.eclipse.jgit:org.eclipse.jgit.ssh.jsch:5.13.1.202206130422-r
| +--- org.eclipse.jgit:org.eclipse.jgit:5.13.1.202206130422-r (*)
| +--- com.jcraft:jsch:0.1.55 -> com.github.mwiede:jsch:0.2.4
| +--- com.jcraft:jzlib:1.1.1
| \--- org.slf4j:slf4j-api:1.7.30
+--- com.jcraft:jsch:0.1.55 -> com.github.mwiede:jsch:0.2.4
+--- com.jcraft:jsch.agentproxy.core:0.0.9
+--- com.jcraft:jsch.agentproxy.jsch:0.0.9
| +--- com.jcraft:jsch:0.1.49 -> com.github.mwiede:jsch:0.2.4
| \--- com.jcraft:jsch.agentproxy.core:0.0.9
+--- com.jcraft:jsch.agentproxy.sshagent:0.0.9
| \--- com.jcraft:jsch.agentproxy.core:0.0.9
+--- com.jcraft:jsch.agentproxy.pageant:0.0.9
| +--- com.jcraft:jsch.agentproxy.core:0.0.9
| +--- net.java.dev.jna:jna:4.1.0
| \--- net.java.dev.jna:jna-platform:4.1.0
| \--- net.java.dev.jna:jna:4.1.0
+--- com.jcraft:jsch.agentproxy.usocket-jna:0.0.9
| +--- com.jcraft:jsch.agentproxy.core:0.0.9
| +--- net.java.dev.jna:jna:4.1.0
| \--- net.java.dev.jna:jna-platform:4.1.0 (*)
+--- com.jcraft:jsch.agentproxy.usocket-nc:0.0.9
| \--- com.jcraft:jsch.agentproxy.core:0.0.9
+--- com.github.zafarkhaja:java-semver:0.9.0
+--- org.eclipse.jgit:org.eclipse.jgit.ssh.apache:5.13.1.202206130422-r
| +--- org.eclipse.jgit:org.eclipse.jgit:5.13.1.202206130422-r (*)
| +--- org.apache.sshd:sshd-osgi:2.7.0
| | +--- org.slf4j:slf4j-api:1.7.30
| | \--- org.slf4j:jcl-over-slf4j:1.7.30
| | \--- org.slf4j:slf4j-api:1.7.30
| +--- org.apache.sshd:sshd-sftp:2.7.0
| | +--- org.apache.sshd:sshd-core:2.7.0
| | | +--- org.apache.sshd:sshd-common:2.7.0
| | | | +--- org.slf4j:slf4j-api:1.7.30
| | | | \--- org.slf4j:jcl-over-slf4j:1.7.30 (*)
| | | +--- org.slf4j:slf4j-api:1.7.30
| | | \--- org.slf4j:jcl-over-slf4j:1.7.30 (*)
| | +--- org.slf4j:slf4j-api:1.7.30
| | \--- org.slf4j:jcl-over-slf4j:1.7.30 (*)
| +--- net.i2p.crypto:eddsa:0.3.0
| \--- org.slf4j:slf4j-api:1.7.30
+--- org.eclipse.jgit:org.eclipse.jgit.ui:5.13.1.202206130422-r
| \--- org.eclipse.jgit:org.eclipse.jgit:5.13.1.202206130422-r (*)
\--- org.eclipse.jgit:org.eclipse.jgit.gpg.bc:5.13.1.202206130422-r
+--- org.eclipse.jgit:org.eclipse.jgit:5.13.1.202206130422-r (*)
+--- org.bouncycastle:bcpg-jdk15on:1.69
| \--- org.bouncycastle:bcprov-jdk15on:1.69
+--- org.bouncycastle:bcprov-jdk15on:1.69
+--- org.bouncycastle:bcutil-jdk15on:1.69
| \--- org.bouncycastle:bcprov-jdk15on:1.69
+--- org.bouncycastle:bcpkix-jdk15on:1.69
| +--- org.bouncycastle:bcprov-jdk15on:1.69
| \--- org.bouncycastle:bcutil-jdk15on:1.69 (*)
\--- org.slf4j:slf4j-api:1.7.30
btw, the transitive dependency comes with jGit, and there was an issue using the fork at https://github.com/mwiede/jsch/issues/85, but it's solved now.