Github user pnowojski commented on the issue:
https://github.com/apache/flink/pull/6073
Converging dependencies by enforcing their versions in root's pom
`dependencyManagement` section is the way that we have chosen previously, so it
would be more consistent.
https://issues.apache.org/jira/browse/FLINK-7765
https://github.com/apache/flink/pull/4777
Thus I would put `janino`'s entries in root pom. Open question is what to
do with `guava` since I do not know if this comment in root pom is still valid
after 3 years and what was it all about:
```
<dependencyManagement>
<!-- WARN:
DO NOT put guava,
protobuf,
asm,
netty
here. It will overwrite Hadoop's guava
dependency (even though we handle it
separatly in the flink-shaded-hadoop module).
-->
```
---
