google / google/guice

Introduce more specific version ranges for osgi Import-Package (e.g. javax.inject)

Open
#891 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
12.7k
Forks
1.7k
Avg merge
11m
Merged PRs (30d)
2

Description

In the bundle manifest, Guice 3 specifies package dependencies on javax.inject and org.aopalliance.intercept. These are not constrained by version ranges however, making Guice very permissive in what versions of these jars it will accept.

Unfortunately in our environment, one of our frameworks reveals a repackaged javax.inject at a version 2+ which Guice consumes. Another bundle relying on Guice (Peaberry) has a more specific version range that prohibits it from consuming javax.inject version 2. This results in Guice/Peaberry failing to see the same version of important annotations.

I understand it to be osgi best practice to specify version ranges on package imports. A more specific range (at least something like (1.0,2]) would be preferable.

Presently we can work around this issue by repackaging Guice with a stricter version import.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.