I ended up reading the Grails code to figure this out, so I thought it might be useful to record.

One of the projects that I recently upgraded to Grails 1.2 makes use of Groovy HTTP-Builder. If you just pull in HTTP-Builder you'll quickly find that it's dependencies break your grails project. So under 1.1.1 and using maven, I had this:

<dependency>
  <groupId>org.codehaus.groovy.modules.http-builder</groupId>
  <artifactId>http-builder</artifactId>
  <version>0.5.0-RC1</version>
  <exclusions>
    <exclusion>
      <groupId>org.codehaus.groovy</groupId>
      <artifactId>groovy</artifactId>
    </exclusion>
    <exclusion>
      <groupId>xml-apis</groupId>
      <artifactId>xml-apis</artifactId>
    </exclusion>
  </exclusions>
</dependency>

New in Grails 1.2 is dependency management via conf/BuildConfig.groovy. There are lots and lots of examples around for how to define dependencies, but significantly less on how to exclude dependencies of those dependencies. So here's mine:

dependencies {
    compile('org.codehaus.groovy.modules.http-builder:http-builder:0.5.0-RC1') {
        excludes 'groovy', 'xml-apis'
    }
}

The thing that caught me out was that there's no groupId specified on the excludes, only an artifactId.

Something else I noticed while reading the dependency code was that the dependency string matching is very limited. Only three parts (groupId:artifactId:version) can be matched. None of the other (ie type or classifier) maven parameters are supported.