`ByteBuddy` scope went beyond `test` in version 2.17.0

[migmruiz]

It seems to me that this was a mistake introduced here
https://github.com/FasterXML/jackson-databind/pull/4254/files/

Originally posted by @migmruiz in #4254 (comment)

[JooHyukKim]

Makes sense. Filed PR #4429 to address this. Thanks @migmruiz!

[cowtowncoder]

UGH. ... and no one noticed/reported this during 2.17.0-rc1. Next time I think it might be best to avoid rc-phase altogether as we keep missing significant problems anyway.

Thank you @migmruiz for reporting this.

[cowtowncoder]

Fixed for 2.17.1.

[yihtserns]

UGH. ... and no one noticed/reported this during 2.17.0-rc1.

Because users have no reason to suspect a new dependency that is not obviously test-only e.g. Mockito or JUnit? It is not like Byte Buddy is a lib that exists only to exclusively help in writing tests anyway e.g. Hibernate uses it. 🤷

I'm guessing @migmruiz noticed it either because he works in a place where every new lib needs justification, or this version of Byte Buddy caused version conflict in his project?

[cowtowncoder]

Ahhh. Very good point that ByteBuddy is NOT regularly test(-only) dependency.
And I can see how for most users added unexpected dependency is hidden by tooling; besides, addition might have been intentional indeed.

Still all that said, I am disappointed that this was not caught and reported before .0 release -- consider the fact that right after 2.17.0 was released this was reported within 24 hours. So my point has more to do with vast difference of reports from "final" minor release vs. any of release candidates: this has been recurring theme. Not just this specific thing, but rate of issue reporting.

[norrisjeremy]

How soon will 2.17.1 be released so that ByteBuddy is no longer pulled in as a transitive dependency?

[pjfanning]

How soon will 2.17.1 be released so that ByteBuddy is no longer pulled in as a transitive dependency?

If you read the comments, you will see that we believe that this is easily worked around. Every build tool that I am aware of has a way to exclude transitive dependencies.

[norrisjeremy]

How soon will 2.17.1 be released so that ByteBuddy is no longer pulled in as a transitive dependency?

If you read the comments, you will see that we believe that this is easily worked around. Every build tool that I am aware of has a way to exclude transitive dependencies.

I'm fully aware of that. But having to manually go thru tens of projects to add an exclusion that we would then turn around and remove after the next release is extremely tedious.
All I was asking was if you had a projected date as to when 2.17.1 would be released, so our team can evaluate if it's worthwhile to go through this exercise, or simply wait.

[pjfanning]

How soon will 2.17.1 be released so that ByteBuddy is no longer pulled in as a transitive dependency?

If you read the comments, you will see that we believe that this is easily worked around. Every build tool that I am aware of has a way to exclude transitive dependencies.

I'm fully aware of that. But having to manually go thru tens of projects to add an exclusion that we would then turn around and remove after the next release is extremely tedious. All I was asking was if you had a projected date as to when 2.17.1 would be released, so our team can evaluate if it's worthwhile to go through this exercise, or simply wait.

There is no plan to release 2.17.1 yet. One option is to revert to 2.16.2.