lll-peanut opened a new pull request, #6438:
URL: https://github.com/apache/shenyu/pull/6438
## What
Add `shenyu-client/DEPENDENCY_GOVERNANCE.md` — a comprehensive dependency
governance rulebook for the shenyu-client module family, which is published
independently as
`shenyu-client-java` artifacts on Maven Central.
## Why
The client artifacts must preserve JDK 8 runtime compatibility even though
the main ShenYu repository has moved to JDK 17. Dependency upgrades can
accidentally break JDK 8 users or
re-couple the client repo to the main repo upgrade path. This document
establishes rules to prevent that.
## Contents
### Document structure (10 sections + 2 appendices)
| Section | Purpose |
|---------|---------|
| §1 Overview | Background, scope, relationship to shenyu-client-java
repo, JDK 8 first principle |
| §2 Runtime Dependency Inventory | 4 tables covering 30+ runtime
dependencies with class version, JDK status, and evidence |
| §3 Test/Tooling Dependency Inventory | 2 tables covering test deps +
build plugins |
| §4 Risky Dependencies Watchlist | 6 🔴 Confirmed ceilings, 6 🟡 Monitor
items, 8 🟢 Stable deps |
| §5 Runtime Upgrade Rules | Golden rule + 6 specific rules |
| §6 Test/Tooling Upgrade Rules | 5 rules + permitted upgrade list |
| §7 Known Exceptions | JaCoCo (§7.1), Byte Buddy (§7.2), SOFA Boot
(§7.3), WireMock divergence (§7.4) |
| §8 PR Verification | 3 local checks + 3 CI checks + 4 rejection criteria
+ PR description template |
| §9 Upgrade Checklist | 14-item copy-paste checklist for contributors |
| §10 Policy Review Cadence | Quarterly review triggers |
| Appendix A | Quick-reference version ceiling table |
| Appendix B | Build verification commands (javap, dependency:tree, class
file scan) |
### Verification methodology
Every dependency claim was verified with **three independent sources**:
1. **JAR bytecode analysis** — class file major version checked via `unzip
-p <jar> <class> | od` for 18 artifacts in local Maven cache
2. **Official project documentation** — WebSearch of release notes,
README, and changelogs for 10 cross-version claims
3. **POM cross-reference** — all 18 version numbers checked against the
actual `shenyu-client-java` repository POMs
### Key findings documented
- **6 confirmed JDK 8 ceilings**: OkHttp (5.x), Mockito (5.x), Caffeine
(3.x), WireMock (3.x), Spring Framework (6.x), JAXB namespace (jakarta.xml.bind
3.x)
- **4 previously incorrect claims corrected during verification**: Guava
(no ceiling yet, #6549 still open), Gson (3.0 doesn't exist), Swagger Core (3.x
doesn't exist), JaCoCo (0.9.x
doesn't exist)
---
Make sure that:
- [x] You have read the [contribution
guidelines](https://shenyu.apache.org/community/contributor-guide).
- [x] You submit test cases (unit or integration tests) that back your
changes.
- [x] Your local test passed `./mvnw clean install
-Dmaven.javadoc.skip=true`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
