From bd1e24ba4e6f0c70d8281d023084470c115c62ad Mon Sep 17 00:00:00 2001
From: cpovirk <cpovirk@google.com>
Date: Mon, 31 Jul 2023 07:51:59 -0700
Subject: [PATCH] Declare dependency versions inline instead of in our parent
 pom.

Fixes https://github.com/google/guava/issues/6654, I hope? If `guava` and its parent pom don't refer to `mockito-core`, then `guava` should no longer affect which version of `mockito-core` is selected by Gradle. (Really, it "shouldn't" even now, but there's a mismatch between Maven's model and Gradle's that causes it to do so.)

As part of resolving a merge conflict in the `android` flavor, I also noticed that I had never added a direct `checker-qual` dependency to that flavor's `guava-testlib` or `guava-tests` configuration, as I should have done back in cl/522315614 or thereabouts. So I added it. (Of course, it matters little because Maven lets us use the `checker-qual` dependency of `guava` transitively.)

It would be nice if we could still declare our dependency versions only once, now by using `properties`. (In fact, my attempt to use `properties` made me notice that our version of the Error Prone _plugin_ is older than our version of the Error Prone _annotations_.) However, if we were to make that change, then we'd lose the ability to update dependencies with `versions-maven-plugin` (`update-properties` + `use-latest-releases`), I assume because the properties are declared in one `pom.xml` and used in another. (It's possible that Dependabot is better about this, but we've had trouble getting it to work with our unusual 2-flavor, Google-repo-source-of-truth setup.)

Tested:
  ```
  $ mvn dependency:tree -Dverbose -X -U &> /tmp/pre

  # made changes

  $ mvn dependency:tree -Dverbose -X -U &> /tmp/post

  $ strip() { cat "$@" | grep -v -e 'Dependency collection stats' -e 'Downloading from' -e 'Progress' -e 'Using connector' -e 'Using transporter' -e 'Using mirror' -e maven-dependency-plugin -e SUCCESS -e 'Total time' -e 'Finished at' | sed -e 's/ (.*managed from.*)//'; }; vimdiff <(strip /tmp/pre) <(strip /tmp/post)
  ```

RELNOTES=Changed our Maven project to avoid [affecting which version of Mockito our Gradle users see](https://github.com/google/guava/issues/6654).
PiperOrigin-RevId: 552479838
---
 android/guava-testlib/pom.xml | 19 +++++++-
 android/guava-tests/pom.xml   | 17 ++++++++
 android/guava/pom.xml         |  4 ++
 android/pom.xml               | 69 +----------------------------
 guava-gwt/pom.xml             | 15 +++++++
 guava-testlib/pom.xml         | 15 ++++++-
 guava-tests/pom.xml           | 15 +++++++
 guava/pom.xml                 |  4 ++
 pom.xml                       | 82 +----------------------------------
 9 files changed, 89 insertions(+), 151 deletions(-)

diff --git a/android/guava-testlib/pom.xml b/android/guava-testlib/pom.xml
index b3211af9c71a..8141ddf87572 100644
--- a/android/guava-testlib/pom.xml
+++ b/android/guava-testlib/pom.xml
@@ -17,14 +17,22 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
+    </dependency>
+    <dependency>
+      <groupId>org.checkerframework</groupId>
+      <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.j2objc</groupId>
       <artifactId>j2objc-annotations</artifactId>
+      <version>2.8</version>
     </dependency>
     <dependency>
       <groupId>${project.groupId}</groupId>
@@ -34,7 +42,8 @@
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-      <scope>compile</scope><!-- testlib must carry these transitively -->
+      <!-- *not* <scope>test</scope>; <scope>compile</scope> is right so that guava-testlib users get junit transitively. -->
+      <version>4.13.2</version>
     </dependency>
     <dependency>
       <!--
@@ -42,7 +51,15 @@
       -->
       <groupId>com.google.truth</groupId>
       <artifactId>truth</artifactId>
+      <version>${truth.version}</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <!-- use the guava we're building. -->
+          <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
   </dependencies>
   <build>
diff --git a/android/guava-tests/pom.xml b/android/guava-tests/pom.xml
index 97ebc0838394..498b83791c56 100644
--- a/android/guava-tests/pom.xml
+++ b/android/guava-tests/pom.xml
@@ -24,30 +24,47 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
+    </dependency>
+    <dependency>
+      <groupId>org.checkerframework</groupId>
+      <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
       <artifactId>mockito-core</artifactId>
+      <version>4.11.0</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.truth</groupId>
       <artifactId>truth</artifactId>
+      <version>${truth.version}</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.jimfs</groupId>
       <artifactId>jimfs</artifactId>
+      <version>1.2</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.caliper</groupId>
       <artifactId>caliper</artifactId>
+      <version>1.0-beta-3</version>
+      <scope>test</scope>
     </dependency>
   </dependencies>
   <build>
diff --git a/android/guava/pom.xml b/android/guava/pom.xml
index 9b03bdddbc6c..646672fc332a 100644
--- a/android/guava/pom.xml
+++ b/android/guava/pom.xml
@@ -31,18 +31,22 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
     </dependency>
     <dependency>
       <groupId>org.checkerframework</groupId>
       <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.j2objc</groupId>
       <artifactId>j2objc-annotations</artifactId>
+      <version>2.8</version>
     </dependency>
     <!-- TODO(cpovirk): does this comment belong on the <dependency> in <profiles>? -->
     <!-- TODO(cpovirk): want this only for dependency plugin but seems not to work there? Maven runs without failure, but the resulting Javadoc is missing the hoped-for inherited text -->
diff --git a/android/pom.xml b/android/pom.xml
index b9e4cbe09cd0..01c985e653ee 100644
--- a/android/pom.xml
+++ b/android/pom.xml
@@ -297,74 +297,7 @@
       <url>scp://dummy.server/dontinstall/usestaging</url>
     </site>
   </distributionManagement>
-  <dependencyManagement>
-    <dependencies>
-      <dependency>
-        <groupId>com.google.code.findbugs</groupId>
-        <artifactId>jsr305</artifactId>
-        <version>3.0.2</version>
-      </dependency>
-      <dependency>
-        <groupId>org.checkerframework</groupId>
-        <artifactId>checker-qual</artifactId>
-        <version>3.33.0</version>
-      </dependency>
-      <dependency>
-        <groupId>com.google.errorprone</groupId>
-        <artifactId>error_prone_annotations</artifactId>
-        <version>2.18.0</version>
-      </dependency>
-      <dependency>
-        <groupId>com.google.j2objc</groupId>
-        <artifactId>j2objc-annotations</artifactId>
-        <version>2.8</version>
-      </dependency>
-      <dependency>
-        <groupId>junit</groupId>
-        <artifactId>junit</artifactId>
-        <version>4.13.2</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>org.mockito</groupId>
-        <artifactId>mockito-core</artifactId>
-        <version>4.11.0</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>com.google.jimfs</groupId>
-        <artifactId>jimfs</artifactId>
-        <version>1.2</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>com.google.truth</groupId>
-        <artifactId>truth</artifactId>
-        <version>${truth.version}</version>
-        <scope>test</scope>
-        <exclusions>
-          <exclusion>
-            <!-- use the guava we're building. -->
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <dependency>
-        <groupId>com.google.caliper</groupId>
-        <artifactId>caliper</artifactId>
-        <version>1.0-beta-3</version>
-        <scope>test</scope>
-        <exclusions>
-          <exclusion>
-            <!-- use the guava we're building. -->
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>
+  <!-- We avoid using dependencyManagement in the parent because of https://github.com/google/guava/issues/6654 -->
   <profiles>
     <profile>
         <id>sonatype-oss-release</id>
diff --git a/guava-gwt/pom.xml b/guava-gwt/pom.xml
index f13e0149305d..8714af0da738 100644
--- a/guava-gwt/pom.xml
+++ b/guava-gwt/pom.xml
@@ -90,6 +90,13 @@
       <version>${truth.version}</version>
       <classifier>gwt</classifier>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <!-- use the guava we're building. -->
+          <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.truth.extensions</groupId>
@@ -97,10 +104,18 @@
       <version>${truth.version}</version>
       <classifier>gwt</classifier>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <!-- use the guava we're building. -->
+          <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.checkerframework</groupId>
       <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
   </dependencies>
   <build>
diff --git a/guava-testlib/pom.xml b/guava-testlib/pom.xml
index 18626fa9362b..889e37cffa77 100644
--- a/guava-testlib/pom.xml
+++ b/guava-testlib/pom.xml
@@ -17,18 +17,22 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
     </dependency>
     <dependency>
       <groupId>org.checkerframework</groupId>
       <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.j2objc</groupId>
       <artifactId>j2objc-annotations</artifactId>
+      <version>2.8</version>
     </dependency>
     <dependency>
       <groupId>${project.groupId}</groupId>
@@ -38,7 +42,8 @@
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-      <scope>compile</scope><!-- testlib must carry these transitively -->
+      <!-- *not* <scope>test</scope>; <scope>compile</scope> is right so that guava-testlib users get junit transitively. -->
+      <version>4.13.2</version>
     </dependency>
     <dependency>
       <!--
@@ -46,7 +51,15 @@
       -->
       <groupId>com.google.truth</groupId>
       <artifactId>truth</artifactId>
+      <version>${truth.version}</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <!-- use the guava we're building. -->
+          <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
   </dependencies>
   <build>
diff --git a/guava-tests/pom.xml b/guava-tests/pom.xml
index 84c982039b49..30a5d7c56d48 100644
--- a/guava-tests/pom.xml
+++ b/guava-tests/pom.xml
@@ -24,38 +24,53 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
     </dependency>
     <dependency>
       <groupId>org.checkerframework</groupId>
       <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
       <artifactId>mockito-core</artifactId>
+      <version>4.11.0</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.truth</groupId>
       <artifactId>truth</artifactId>
+      <version>${truth.version}</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.truth.extensions</groupId>
       <artifactId>truth-java8-extension</artifactId>
+      <version>${truth.version}</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.jimfs</groupId>
       <artifactId>jimfs</artifactId>
+      <version>1.2</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.caliper</groupId>
       <artifactId>caliper</artifactId>
+      <version>1.0-beta-3</version>
+      <scope>test</scope>
     </dependency>
   </dependencies>
   <build>
diff --git a/guava/pom.xml b/guava/pom.xml
index e1a5fe527da9..baba51ed48c7 100644
--- a/guava/pom.xml
+++ b/guava/pom.xml
@@ -31,18 +31,22 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
     </dependency>
     <dependency>
       <groupId>org.checkerframework</groupId>
       <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.j2objc</groupId>
       <artifactId>j2objc-annotations</artifactId>
+      <version>2.8</version>
     </dependency>
     <!-- TODO(cpovirk): does this comment belong on the <dependency> in <profiles>? -->
     <!-- TODO(cpovirk): want this only for dependency plugin but seems not to work there? Maven runs without failure, but the resulting Javadoc is missing the hoped-for inherited text -->
diff --git a/pom.xml b/pom.xml
index 3b63419f0683..2bbfa227f06a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -291,87 +291,7 @@
       <url>scp://dummy.server/dontinstall/usestaging</url>
     </site>
   </distributionManagement>
-  <dependencyManagement>
-    <dependencies>
-      <dependency>
-        <groupId>com.google.code.findbugs</groupId>
-        <artifactId>jsr305</artifactId>
-        <version>3.0.2</version>
-      </dependency>
-      <dependency>
-        <groupId>org.checkerframework</groupId>
-        <artifactId>checker-qual</artifactId>
-        <version>3.33.0</version>
-      </dependency>
-      <dependency>
-        <groupId>com.google.errorprone</groupId>
-        <artifactId>error_prone_annotations</artifactId>
-        <version>2.18.0</version>
-      </dependency>
-      <dependency>
-        <groupId>com.google.j2objc</groupId>
-        <artifactId>j2objc-annotations</artifactId>
-        <version>2.8</version>
-      </dependency>
-      <dependency>
-        <groupId>junit</groupId>
-        <artifactId>junit</artifactId>
-        <version>4.13.2</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>org.mockito</groupId>
-        <artifactId>mockito-core</artifactId>
-        <version>4.11.0</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>com.google.jimfs</groupId>
-        <artifactId>jimfs</artifactId>
-        <version>1.2</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>com.google.truth</groupId>
-        <artifactId>truth</artifactId>
-        <version>${truth.version}</version>
-        <scope>test</scope>
-        <exclusions>
-          <exclusion>
-            <!-- use the guava we're building. -->
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <dependency>
-        <groupId>com.google.truth.extensions</groupId>
-        <artifactId>truth-java8-extension</artifactId>
-        <version>${truth.version}</version>
-        <scope>test</scope>
-        <exclusions>
-          <exclusion>
-            <!-- use the guava we're building. -->
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <dependency>
-        <groupId>com.google.caliper</groupId>
-        <artifactId>caliper</artifactId>
-        <version>1.0-beta-3</version>
-        <scope>test</scope>
-        <exclusions>
-          <exclusion>
-            <!-- use the guava we're building. -->
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>
+  <!-- We avoid using dependencyManagement in the parent because of https://github.com/google/guava/issues/6654 -->
   <profiles>
     <profile>
         <id>sonatype-oss-release</id>