Remove `net.javacrumbs.future-converter` dependency
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 85
- Forks
- 26
- Avg merge
- 11h 49m
- Merged PRs (30d)
- 22
Description
Hello!
- Vote on this issue by adding a 👍 reaction
- If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)
Issue details
The dependency net.javacrumbs.future-converter recently got flagged on a user's Black Duck scan for having a viral GPL license. I'm not actually sure why that's getting flagged, as the package itself is Apache 2, but I also don't fully understand the whole dependency tree of different Futures frameworks that gets pulled in via future-converter-common. I've asked for more details.
That said, we've already got a TODO in our gradle file to remove / inline this dependency given the functionality it provides is fairly trivial. We should act on that TODO if it's going to be causing issues in popular dependency scanning software.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in sdk/java/pulumi/build.gradle at the linked TODO and inspect how net.javacrumbs.future-converter is used. Trace the related future-converter-common dependencies before determining whether the small functionality can be inlined; done means the dependency and unnecessary transitive frameworks are removed without breaking the relevant Gradle build or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100