Does an Android dependency ship in every build variant?

Yes, by default. Android's documentation says the standard configurations apply dependencies to all build variants. To limit a library to one variant, flavor or test source set, use a configuration prefixed with that name, such as freeImplementation. Then scan each variant you ship, because a scan of one variant says little about another.

What the docs say

Android's dependency guide states that all of the standard configurations, such as implementation and api, apply to all build variants. To scope a dependency, capitalize the configuration name and prefix it with the variant or source set name:

dependencies {
    freeImplementation("com.google.firebase:firebase-ads:21.5.1")
    testImplementation("junit:junit:4.12")
    androidTestImplementation("androidx.test.espresso:espresso-core:3.6.1")
}

For a combined flavor and build type, the docs say you must first initialize the configuration, using a creating declaration, before adding to it.

Why this matters for security

An ads library that only the free flavor includes is a risk for free users and not for paid users. A debug only tool is a risk for internal builds and not for the Play release. If your inventory merges them all, you will raise alerts for components that never ship, or worse, you will check one variant and assume the rest match.

Configuration cheat sheet

The docs also note that compileOnly cannot be used with AAR dependencies.

Steps to scan the right thing

1. List your build types and product flavors.
2. For each variant you publish, resolve its runtime classpath, not just the declared list.
3. Produce one SBOM per shipped variant, or one SBOM with variant tags.
4. Exclude test configurations from release decisions, but keep them for developer machine hygiene.
5. Compare variants: any component that appears in one and not another should have a reason.
6. Review dependency scoped declarations in code review.

Reading the output

If two variants differ, look at the declarations first. Often a flavor includes an extra SDK. Check what the SDK does, what data it collects and which permissions it adds. See why does my Android app ask for permissions I never added for how libraries contribute permissions.

For a full listing technique, see how to list every dependency in an Android Gradle app.

Try it yourself

Click through it at your own pace, or open it full screen.

Watch how findings shrink once you ask whether the code is actually used. The same thinking applies to variants.

Safeguard's reachability analysis and dependency scanning help separate present components from used ones, and the free scan is at gold.safeguard.sh/scan.

Quick check

Sources

• Android: Add build dependencies

Last reviewed: 19 October 2026.