Declare dependency versions inline instead of in our parent pom.

Fixes #6654, I hope? If `guava` and its parent pom don't refer to `mockito-core`, then `guava` should no longer affect which version of `mockito-core` is selected by Gradle. (Really, it "shouldn't" even now, but there's a mismatch between Maven's model and Gradle's that causes it to do so.) As part of resolving a merge conflict in the `android` flavor, I also noticed that I had never added a direct `checker-qual` dependency to that flavor's `guava-testlib` or `guava-tests` configuration, as I should have done back in cl/522315614 or thereabouts. So I added it. (Of course, it matters little because Maven lets us use the `checker-qual` dependency of `guava` transitively.) It would be nice if we could still declare our dependency versions only once, now by using `properties`. (In fact, my attempt to use `properties` made me notice that our version of the Error Prone _plugin_ is older than our version of the Error Prone _annotations_.) However, if we were to make that change, then we'd lose the ability to update dependencies with `versions-maven-plugin` (`update-properties` + `use-latest-releases`), I assume because the properties are declared in one `pom.xml` and used in another. (It's possible that Dependabot is better about this, but we've had trouble getting it to work with our unusual 2-flavor, Google-repo-source-of-truth setup.) Tested: ``` $ mvn dependency:tree -Dverbose -X -U &> /tmp/pre # made changes $ mvn dependency:tree -Dverbose -X -U &> /tmp/post $ strip() { cat "$@" | grep -v -e 'Dependency collection stats' -e 'Downloading from' -e 'Progress' -e 'Using connector' -e 'Using transporter' -e 'Using mirror' -e maven-dependency-plugin -e SUCCESS -e 'Total time' -e 'Finished at' | sed -e 's/ (.*managed from.*)//'; }; vimdiff <(strip /tmp/pre) <(strip /tmp/post) ``` RELNOTES=Changed our Maven project to avoid [affecting which version of Mockito our Gradle users see](#6654). PiperOrigin-RevId: 552479838
google · copybara-service · Jul 31, 2023 · Jul 31, 2023 · bd1e24ba4e6f0c70d8281d023084470c115c62ad
commit bd1e24ba4e6f0c70d8281d023084470c115c62ad
diff --git a/android/guava-testlib/pom.xml b/android/guava-testlib/pom.xml
@@ -17,14 +17,22 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
+    </dependency>
+    <dependency>
+      <groupId>org.checkerframework</groupId>
+      <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.j2objc</groupId>
       <artifactId>j2objc-annotations</artifactId>
+      <version>2.8</version>
     </dependency>
     <dependency>
       <groupId>${project.groupId}</groupId>
@@ -34,15 +42,24 @@
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-      <scope>compile</scope><!-- testlib must carry these transitively -->
+      <!-- *not* <scope>test</scope>; <scope>compile</scope> is right so that guava-testlib users get junit transitively. -->
+      <version>4.13.2</version>
     </dependency>
     <dependency>
       <!--
       Do not include Truth in non-test scope! Doing so creates a problematic dependency cycle.
       -->
       <groupId>com.google.truth</groupId>
       <artifactId>truth</artifactId>
+      <version>${truth.version}</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <!-- use the guava we're building. -->
+          <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
   </dependencies>
   <build>

diff --git a/android/guava-tests/pom.xml b/android/guava-tests/pom.xml
@@ -24,30 +24,47 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
+    </dependency>
+    <dependency>
+      <groupId>org.checkerframework</groupId>
+      <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
       <artifactId>mockito-core</artifactId>
+      <version>4.11.0</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.truth</groupId>
       <artifactId>truth</artifactId>
+      <version>${truth.version}</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.jimfs</groupId>
       <artifactId>jimfs</artifactId>
+      <version>1.2</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.caliper</groupId>
       <artifactId>caliper</artifactId>
+      <version>1.0-beta-3</version>
+      <scope>test</scope>
     </dependency>
   </dependencies>
   <build>

diff --git a/android/guava/pom.xml b/android/guava/pom.xml
@@ -31,18 +31,22 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
     </dependency>
     <dependency>
       <groupId>org.checkerframework</groupId>
       <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.j2objc</groupId>
       <artifactId>j2objc-annotations</artifactId>
+      <version>2.8</version>
     </dependency>
     <!-- TODO(cpovirk): does this comment belong on the <dependency> in <profiles>? -->
     <!-- TODO(cpovirk): want this only for dependency plugin but seems not to work there? Maven runs without failure, but the resulting Javadoc is missing the hoped-for inherited text -->

diff --git a/android/pom.xml b/android/pom.xml
@@ -297,74 +297,7 @@
       <url>scp://dummy.server/dontinstall/usestaging</url>
     </site>
   </distributionManagement>
-  <dependencyManagement>
-    <dependencies>
-      <dependency>
-        <groupId>com.google.code.findbugs</groupId>
-        <artifactId>jsr305</artifactId>
-        <version>3.0.2</version>
-      </dependency>
-      <dependency>
-        <groupId>org.checkerframework</groupId>
-        <artifactId>checker-qual</artifactId>
-        <version>3.33.0</version>
-      </dependency>
-      <dependency>
-        <groupId>com.google.errorprone</groupId>
-        <artifactId>error_prone_annotations</artifactId>
-        <version>2.18.0</version>
-      </dependency>
-      <dependency>
-        <groupId>com.google.j2objc</groupId>
-        <artifactId>j2objc-annotations</artifactId>
-        <version>2.8</version>
-      </dependency>
-      <dependency>
-        <groupId>junit</groupId>
-        <artifactId>junit</artifactId>
-        <version>4.13.2</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>org.mockito</groupId>
-        <artifactId>mockito-core</artifactId>
-        <version>4.11.0</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>com.google.jimfs</groupId>
-        <artifactId>jimfs</artifactId>
-        <version>1.2</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>com.google.truth</groupId>
-        <artifactId>truth</artifactId>
-        <version>${truth.version}</version>
-        <scope>test</scope>
-        <exclusions>
-          <exclusion>
-            <!-- use the guava we're building. -->
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <dependency>
-        <groupId>com.google.caliper</groupId>
-        <artifactId>caliper</artifactId>
-        <version>1.0-beta-3</version>
-        <scope>test</scope>
-        <exclusions>
-          <exclusion>
-            <!-- use the guava we're building. -->
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>
+  <!-- We avoid using dependencyManagement in the parent because of https://github.com/google/guava/issues/6654 -->
   <profiles>
     <profile>
         <id>sonatype-oss-release</id>

diff --git a/guava-gwt/pom.xml b/guava-gwt/pom.xml
@@ -90,17 +90,32 @@
       <version>${truth.version}</version>
       <classifier>gwt</classifier>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <!-- use the guava we're building. -->
+          <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.truth.extensions</groupId>
       <artifactId>truth-java8-extension</artifactId>
       <version>${truth.version}</version>
       <classifier>gwt</classifier>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <!-- use the guava we're building. -->
+          <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.checkerframework</groupId>
       <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
   </dependencies>
   <build>

diff --git a/guava-testlib/pom.xml b/guava-testlib/pom.xml
@@ -17,18 +17,22 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
     </dependency>
     <dependency>
       <groupId>org.checkerframework</groupId>
       <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.j2objc</groupId>
       <artifactId>j2objc-annotations</artifactId>
+      <version>2.8</version>
     </dependency>
     <dependency>
       <groupId>${project.groupId}</groupId>
@@ -38,15 +42,24 @@
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-      <scope>compile</scope><!-- testlib must carry these transitively -->
+      <!-- *not* <scope>test</scope>; <scope>compile</scope> is right so that guava-testlib users get junit transitively. -->
+      <version>4.13.2</version>
     </dependency>
     <dependency>
       <!--
       Do not include Truth in non-test scope! Doing so creates a problematic dependency cycle.
       -->
       <groupId>com.google.truth</groupId>
       <artifactId>truth</artifactId>
+      <version>${truth.version}</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <!-- use the guava we're building. -->
+          <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
   </dependencies>
   <build>

diff --git a/guava-tests/pom.xml b/guava-tests/pom.xml
@@ -24,38 +24,53 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
     </dependency>
     <dependency>
       <groupId>org.checkerframework</groupId>
       <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.mockito</groupId>
       <artifactId>mockito-core</artifactId>
+      <version>4.11.0</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.truth</groupId>
       <artifactId>truth</artifactId>
+      <version>${truth.version}</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.truth.extensions</groupId>
       <artifactId>truth-java8-extension</artifactId>
+      <version>${truth.version}</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.jimfs</groupId>
       <artifactId>jimfs</artifactId>
+      <version>1.2</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.caliper</groupId>
       <artifactId>caliper</artifactId>
+      <version>1.0-beta-3</version>
+      <scope>test</scope>
     </dependency>
   </dependencies>
   <build>

diff --git a/guava/pom.xml b/guava/pom.xml
@@ -31,18 +31,22 @@
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
     </dependency>
     <dependency>
       <groupId>org.checkerframework</groupId>
       <artifactId>checker-qual</artifactId>
+      <version>3.33.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
+      <version>2.18.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.j2objc</groupId>
       <artifactId>j2objc-annotations</artifactId>
+      <version>2.8</version>
     </dependency>
     <!-- TODO(cpovirk): does this comment belong on the <dependency> in <profiles>? -->
     <!-- TODO(cpovirk): want this only for dependency plugin but seems not to work there? Maven runs without failure, but the resulting Javadoc is missing the hoped-for inherited text -->

diff --git a/pom.xml b/pom.xml
@@ -291,87 +291,7 @@
       <url>scp://dummy.server/dontinstall/usestaging</url>
     </site>
   </distributionManagement>
-  <dependencyManagement>
-    <dependencies>
-      <dependency>
-        <groupId>com.google.code.findbugs</groupId>
-        <artifactId>jsr305</artifactId>
-        <version>3.0.2</version>
-      </dependency>
-      <dependency>
-        <groupId>org.checkerframework</groupId>
-        <artifactId>checker-qual</artifactId>
-        <version>3.33.0</version>
-      </dependency>
-      <dependency>
-        <groupId>com.google.errorprone</groupId>
-        <artifactId>error_prone_annotations</artifactId>
-        <version>2.18.0</version>
-      </dependency>
-      <dependency>
-        <groupId>com.google.j2objc</groupId>
-        <artifactId>j2objc-annotations</artifactId>
-        <version>2.8</version>
-      </dependency>
-      <dependency>
-        <groupId>junit</groupId>
-        <artifactId>junit</artifactId>
-        <version>4.13.2</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>org.mockito</groupId>
-        <artifactId>mockito-core</artifactId>
-        <version>4.11.0</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>com.google.jimfs</groupId>
-        <artifactId>jimfs</artifactId>
-        <version>1.2</version>
-        <scope>test</scope>
-      </dependency>
-      <dependency>
-        <groupId>com.google.truth</groupId>
-        <artifactId>truth</artifactId>
-        <version>${truth.version}</version>
-        <scope>test</scope>
-        <exclusions>
-          <exclusion>
-            <!-- use the guava we're building. -->
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <dependency>
-        <groupId>com.google.truth.extensions</groupId>
-        <artifactId>truth-java8-extension</artifactId>
-        <version>${truth.version}</version>
-        <scope>test</scope>
-        <exclusions>
-          <exclusion>
-            <!-- use the guava we're building. -->
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-      <dependency>
-        <groupId>com.google.caliper</groupId>
-        <artifactId>caliper</artifactId>
-        <version>1.0-beta-3</version>
-        <scope>test</scope>
-        <exclusions>
-          <exclusion>
-            <!-- use the guava we're building. -->
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-          </exclusion>
-        </exclusions>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>
+  <!-- We avoid using dependencyManagement in the parent because of https://github.com/google/guava/issues/6654 -->
   <profiles>
     <profile>
         <id>sonatype-oss-release</id>