Introduce more specific version ranges for osgi Import-Package (e.g. javax.inject)
- Dominant language
- Java
- Stars
- 12.7k
- Forks
- 1.7k
- Avg merge
- 11m
- Merged PRs (30d)
- 2
Description
In the bundle manifest, Guice 3 specifies package dependencies on javax.inject and org.aopalliance.intercept. These are not constrained by version ranges however, making Guice very permissive in what versions of these jars it will accept.
Unfortunately in our environment, one of our frameworks reveals a repackaged javax.inject at a version 2+ which Guice consumes. Another bundle relying on Guice (Peaberry) has a more specific version range that prohibits it from consuming javax.inject version 2. This results in Guice/Peaberry failing to see the same version of important annotations.
I understand it to be osgi best practice to specify version ranges on package imports. A more specific range (at least something like (1.0,2]) would be preferable.
Presently we can work around this issue by repackaging Guice with a stricter version import.
Contributor guide
Assessment
This issue has not been assessed yet.