[MNG-7068] Active dependency management for Google Guice/Guava

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.6.3
• Fix Version/s: 3.9.0, 4.0.0-alpha-2, 4.0.0
• Component/s: Dependencies
• Assignee: Michael Osipov
• Reporter: Boris Unckel
• Created: 05/Jan/21 21:38
• Updated: 20/Oct/22 08:11
• Resolved: 06/Mar/22 21:12

Description

The current pom includes com.google.inject:guice with the default transitive dependency of com.google.guava:guava. Guava has declared several dependencies, which are not needed at runtime. Only com.google.guava:failureaccess is needed.

The proposal is first to add com.google.guava:guava to the excludes of guice. Second guava and failureaccess shall be added as direct dependencies.

This has two advantages: Downstream projects only get the needed dependencies and the version of guava can be independently set.

The runtime dependencies for Guava are explained in the last section of the README "Important Warnings" #3

Issue Links

• is related to: MNG-7502 Upgrade Guice to 5.1.0
• relates to: MRESOLVER-156 Active dependency management for Google Guice/Guava
• links to: GitHub Pull Request #426