Github user twalthr commented on the issue:
https://github.com/apache/flink/pull/6073
We had a dependency on Janino before so this adds no additional dependency
to our module. The only special case is about guava (as always). I think you
have the bigger picture about Flink's dependency management, I'm open for other
solutions (like disabling the enforcer plugin etc.).---
