[OAK-10307] oak-shaded-guava leaks original guava as transitive dependency

• Type: Technical task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.54.0
• Component/s: shaded-guava
• Assignee: Julian Reschke
• Reporter: Marcel Reutegger
• Created: 15/Jun/23 12:42
• Updated: 24/Jul/23 17:33
• Resolved: 22/Jun/23 15:58

Description

oak-shaded-guava currently declares a compile dependency on original guava. This means modules using oak-shaded-guava will transitively get original guava and mistakingly use classes from there.

$ mvn dependency:tree -pl :oak-shaded-guava
[INFO] Scanning for projects...
[INFO]
[INFO] ---------------< org.apache.jackrabbit:oak-shaded-guava >---------------
[INFO] Building Jackrabbit Guava Wrapper 1.53-SNAPSHOT
[INFO]   from pom.xml
[INFO] -------------------------------[ bundle ]-------------------------------
[INFO]
[INFO] --- dependency:3.4.0:tree (default-cli) @ oak-shaded-guava ---
[INFO] org.apache.jackrabbit:oak-shaded-guava:bundle:1.53-SNAPSHOT
[INFO] +- com.google.guava:guava:jar:32.0.1-jre:compile
[INFO] |  +- com.google.guava:failureaccess:jar:1.0.1:compile
[INFO] |  +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO] |  +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO] |  +- org.checkerframework:checker-qual:jar:3.33.0:compile
[INFO] |  +- com.google.errorprone:error_prone_annotations:jar:2.18.0:compile
[INFO] |  \- com.google.j2objc:j2objc-annotations:jar:2.8:compile
[INFO] +- org.osgi:org.osgi.annotation:jar:6.0.0:provided
[INFO] \- org.jetbrains:annotations:jar:18.0.0:provided

Issue Links

• is related to: OAK-9989 introduce oak-shaded-guava project
• relates to: OAK-10361 Exclude dependency-reduced-pom.xml from the source package during release
• links to: GitHub Pull Request #994