Hi, I don't exactly understand what you mean by "anyone who wants to shade in Guava can still do that". If you mean "anyone can make their own build of Guice", then it's quite a burden: you need to maintain a private maven repo only for this modified build of Guice for lifetime (at least for the lifetime of your project), rebuild it each time a new upstream Guice version is released etc... If you have something else in mind, then please kindly elaborate when you have a moment: maybe I'm missing some nice and easy solution ;-)
OTOH, maven-shade-plugin also has `shadedArtifactAttached` and `shadedClassifierName` flags which allow to build and deploy both jars at once (with and without shaded+relocated+minimized Guava). This way it would be easy for everyone, right? Cheers! On Thursday, December 9, 2021 at 7:43:43 PM UTC+7 mcc...@gmail.com wrote: > You'll find that while it saves some space it will still pull in a lot of > Guava, which is the main reason why Guice stopped shading it in for > everyone. > > With the current setup anyone who wants to shade in Guava can still do > that, while everyone else is free to use a common Guava library without the > bloat. > > One compromise could be to add a "guice-all" module to the build which > puts Guice and its implementation dependencies into an uber jar. > > (Although if there's a security issue in the version of Guava shaded in > then you'd then need to wait for a new release of Guice vs. shading it > yourself.) > > > On Thu, 9 Dec 2021 at 12:04, Piotr Morgwai Kotarbinski <mor...@gmail.com> > wrote: > >> hmm, it's just come to me that maybe it's possible to achieve the same >> result without a need for guice-guava, using only maven-shade-plugin's >> filters and "minimizeJar" option: in theory it should exactly include only >> classes that the project actually uses: >> https://maven.apache.org/plugins/maven-shade-plugin/shade-mojo.html#minimizeJar >> (which makes me wonder why wasn't it used in the first place back when >> Guava was shaded...) >> >> On Thursday, December 9, 2021 at 2:10:57 PM UTC+7 Piotr Morgwai >> Kotarbinski wrote: >> >>> Unfortunately I think that the part "get the PR accepted" is the main >>> blocker here: I doubt google would be interested in such change: internally >>> they build everything from HEAD of each dependency each time (or at least >>> they used to), so versioning is not an issue for them. On top of this, they >>> use Guice for almost every piece of Java code (again, at least they used >>> to), so I'm afraid they will view any change that does not solve some of >>> *their* problems as an unnecessary risk. On top of on top of this add >>> general unresponsiveness of google to issues and PRs on Guice github repo, >>> so even just starting a discussion what could possibly be an acceptable >>> solution from google's point of view may turn impossible. >>> As a consequence, anyone undertaking such task will risk all of his work >>> to never be accepted (or even considered) due to these "political" reasons >>> regardless of his solution's quality and usefulness for non-google users :( >>> >>> At least for the sake of this conversation, let's try to discuss >>> possible approaches nevertheless: >>> - duplicating Guava's functionality directly into Guice is an ugly >>> solution, introduces maintenance problems and IMO should NOT be ever >>> accepted. >>> - putting Guava's functionality required by Guice into a separate lib >>> (let's call it "guice-guava") and creating in Guice's pom an additional >>> profile that uses this lib (shaded and relocated) instead of Guava: this >>> way Guice code stays pure, but this new lib has exactly the same problems >>> as described in the previous point. >>> - creating guice-guava by including Guava as its submodule and linking >>> from `src/main/java` to a subset of java files in guice-guava submodule >>> folder (hence including only necessary classes in guice-guava) may be >>> reasonable solution. Whether it's actually feasible depends how deep is the >>> dependency graph of Guava classes required by Guice. >>> >>> Cheers! >>> >>> On Friday, December 3, 2021 at 3:31:40 AM UTC+7 Brian Pontarelli wrote: >>> >>>> I agree 100%. >>>> >>>> My offer of a bounty still stands. Seriously. Happy to discuss actual >>>> numbers, but it would definitely be worth it for us to pay a good rate to >>>> get this fixed. FusionAuth would be the corporate sponsor of this effort >>>> in >>>> case anyone is interested. >>>> >>>> — Brian >>>> >>>> On Nov 19, 2021, at 1:35 PM, Piotr Morgwai Kotarbinski < >>>> mor...@gmail.com> wrote: >>>> >>>> IMO, if a lib breaks backwards compatibility so often as Guava, it must >>>> be shaded: otherwise conflicts are unavoidable. The real problem is that >>>> Guava is too big as mentioned before. The right solution IMO would be to >>>> split it to smaller sub-libs. This way shading a small part that Guice >>>> depends on, would not be a problem anymore. >>>> >>>> Cheers! >>>> >>>> On Monday, April 5, 2021 at 9:43:26 PM UTC+7 Brian Pontarelli wrote: >>>> >>>>> I understand why it would be best to leave Guava out of shading, but >>>>> it really causes issues because of the way that Guava manages releases >>>>> and >>>>> versioning. The fact that it is on major version 27 while many projects >>>>> are >>>>> using version 10 is an issue. Every time a library upgrades Guava, we are >>>>> all just hoping that it doesn’t break out entire classpath at runtime due >>>>> to some incompatible change. And manually shading everything in our >>>>> classpath for every upgrade is not feasible (hence the reason we are >>>>> removing Guava deps whenever possible). >>>>> >>>>> I’d be willing to provide a bounty if someone is willing to remove >>>>> Guava completely and can get the PR accepted. >>>>> >>>>> — Brian >>>>> >>>>> On Mar 14, 2021, at 4:57 PM, Stuart McCulloch <mcc...@gmail.com> >>>>> wrote: >>>>> >>>>> >>>>> On Fri, 19 Feb 2021 at 18:44, Brian Pontarelli <br...@pontarelli.com> >>>>> wrote: >>>>> >>>>>> I’d be interested in this as well since we will be upgrading to Java >>>>>> 17 for FusionAuth once it is released. >>>>>> >>>>>> And not to hijack, but will it be possible to remove Guava and all >>>>>> shaded deps? >>>>>> >>>>> >>>>> In the latest release (5.0.1) the CGLIB dependency has been removed >>>>> leaving ASM as the only shaded dependency - because it's shaded it >>>>> shouldn't conflict with other versions on your classpath. >>>>> >>>>> Guava used to be shaded as well, but this caused overhead for users >>>>> who were also using Guava elsewhere in their application. It also made it >>>>> harder to pick up Guava fixes in-between releases of Guice. So it's now a >>>>> direct dependency that people can decide to shade themselves if they want >>>>> to use different versions on their classpath. >>>>> >>>>> Removing Guava completely would be a big undertaking - it's not part >>>>> of the public API, but the internals use it for caches and multimap >>>>> support. >>>>> >>>>> Guava is a great example of how not to manage a library and it keeps >>>>>> rolling major versions that break compatibility. Tons of libraries uses >>>>>> different versions and regularly break our classpath. We are slowly >>>>>> yanking >>>>>> libraries in FusionAuth that use CGLIB, ASM, and Guava. It would be >>>>>> awesome >>>>>> if Guice could yank those deps. Ideally, Guice would have no deps >>>>>> (except >>>>>> javax.inject) and just be a drop in lib. >>>>>> >>>>>> — Brian >>>>>> >>>>>> On Feb 19, 2021, at 11:05 AM, Peter Burka <pe...@quux.net> wrote: >>>>>> >>>>>> Java 17 will be released later this year, and will be the first long >>>>>> term support (LTS) OpenJDK version since Java 11 in 2018. I imagine that >>>>>> Guice 5 will add support for Java 17, however the current beta version >>>>>> does >>>>>> not work on Java 17 early-access as it includes an out-of-date shaded >>>>>> version of ASM. >>>>>> >>>>>> What is the anticipated schedule for releasing Guice 5? Will it be >>>>>> available before Java 17? Will there be any additional beta releases >>>>>> before >>>>>> GA? >>>>>> >>>>>> Are there any plans to update Guice 4 with Java 17 support, too? >>>>>> >>>>>> Thank you! >>>>>> >>>>>> >>>>>> -- >>>>>> You received this message because you are subscribed to the Google >>>>>> Groups "google-guice" group. >>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>> send an email to google-guice...@googlegroups.com. >>>>>> To view this discussion on the web visit >>>>>> https://groups.google.com/d/msgid/google-guice/88f24d78-f0b0-4633-881b-44deb050610fn%40googlegroups.com >>>>>> >>>>>> <https://groups.google.com/d/msgid/google-guice/88f24d78-f0b0-4633-881b-44deb050610fn%40googlegroups.com?utm_medium=email&utm_source=footer> >>>>>> . >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> You received this message because you are subscribed to the Google >>>>>> Groups "google-guice" group. >>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>> send an email to google-guice...@googlegroups.com. >>>>>> To view this discussion on the web visit >>>>>> https://groups.google.com/d/msgid/google-guice/AF183807-C0A0-4C3B-8C23-6B93F89D4BA9%40pontarelli.com >>>>>> >>>>>> <https://groups.google.com/d/msgid/google-guice/AF183807-C0A0-4C3B-8C23-6B93F89D4BA9%40pontarelli.com?utm_medium=email&utm_source=footer> >>>>>> . >>>>>> >>>>> >>>>> -- >>>>> You received this message because you are subscribed to the Google >>>>> Groups "google-guice" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send >>>>> an email to google-guice...@googlegroups.com. >>>>> >>>>> To view this discussion on the web visit >>>>> https://groups.google.com/d/msgid/google-guice/CAMr6Z4%3DLAU4QDiH_gvJ%2BtMm1SpWDhdpPcZ6GB3oqm%3Dnm%2Bc%2BtNQ%40mail.gmail.com >>>>> >>>>> <https://groups.google.com/d/msgid/google-guice/CAMr6Z4%3DLAU4QDiH_gvJ%2BtMm1SpWDhdpPcZ6GB3oqm%3Dnm%2Bc%2BtNQ%40mail.gmail.com?utm_medium=email&utm_source=footer> >>>>> . >>>>> >>>>> >>>>> >>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "google-guice" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to google-guice...@googlegroups.com. >>>> >>>> To view this discussion on the web visit >>>> https://groups.google.com/d/msgid/google-guice/1eb953bf-675b-4d09-8dea-00c38db8a7f4n%40googlegroups.com >>>> >>>> <https://groups.google.com/d/msgid/google-guice/1eb953bf-675b-4d09-8dea-00c38db8a7f4n%40googlegroups.com?utm_medium=email&utm_source=footer> >>>> . >>>> >>>> >>>> -- >> You received this message because you are subscribed to the Google Groups >> "google-guice" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to google-guice...@googlegroups.com. >> > To view this discussion on the web visit >> https://groups.google.com/d/msgid/google-guice/ee3eea18-a9ea-4a21-9ff8-8d2a496e511en%40googlegroups.com >> >> <https://groups.google.com/d/msgid/google-guice/ee3eea18-a9ea-4a21-9ff8-8d2a496e511en%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> > -- You received this message because you are subscribed to the Google Groups "google-guice" group. To unsubscribe from this group and stop receiving emails from it, send an email to google-guice+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/google-guice/8717c4c2-7c53-47af-aee1-012b788b5d6an%40googlegroups.com.
