slachiewicz opened a new pull request, #429: URL: https://github.com/apache/maven-shared-utils/pull/429
Declares `org.jspecify:jspecify` at `provided` scope, as `com.google.code.findbugs:jsr305` was before the migration in `6e77398`. The migration changed the scope along with the artifact. That is a quiet change to the dependency graph of every consumer -- roughly 30 projects in the Maven estate, Maven 3.9.x among them -- for an annotations-only jar none of them asked for. `provided` restores the graph 3.4.2 consumers already had. Nothing is lost at compile time. `provided` is on the compile classpath, and `NonNull` and `Nullable` are still written into the class files; I checked with `javap -v`. The annotations are `RetentionPolicy.RUNTIME`, so the only thing that changes is a consumer reflecting on them by name at runtime with the jar absent -- the JVM silently omits annotations it cannot resolve rather than failing. Nothing in this library or its callers does that. After the change, `dependency:list -DincludeScope=runtime` yields `slf4j-api`, `jansi` (optional) and `commons-io`, and no jspecify. Worth a second opinion if you would rather follow JSpecify's own recommendation of a normal compile dependency; the jar is only 3 KB. The argument for `provided` is consistency with the prior art in this very pom and leaving 30 consumers' graphs untouched, not size. Verified: `mvn -B verify` on JDK 17 -> Tests run: 788, Failures: 0, Errors: 0. Spotless clean. *This change was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
