That, and also when caffeine came out it replaced one of the major uses (caching) of guava.

https://github.com/ben-manes/caffeine

Yeah this was about the last piece I’d really go to Guava for and Caffeine has been better for years at this point.

Indeed, and now it's just a hassle dealing with Guava CVEs that get flagged up for functionality that doesn't actually require Guava.

And dealing with mismatching guava versions brought in as transitive dependencies.

Even better is getting Gradle/Maven to correctly pull "plain" vs "Android" versions of the package instead of them just publishing the diverging code base as two repository packages.

https://github.com/google/guava/issues/2914

I wish Guava weren’t just one library that breaks backward compatibility casually. They follow semver, but the major version changes so often that it’s not that helpful (they’re up to 32.x!)

What about just staying with older version, if you don’t have capacity to upgrade?

The problem is conflicting transitives, lib A depends on 29, B on 31.

Does Java have a solution for such things where both libs can use their own version without them conflicting (unless they hand out Guava types to others, of course)? Custom class loaders?

Java doesn’t have a universal practical solution for this. Principled solutions based on custom class loaders (such as OSGi) added tremendous complexity and created more problems than they solved. Other solutions such as shading (renaming classes and their usages to prevent name conflicts between different versions) work in some cases but have their own limitations and drawbacks.

What about Java modules (aka JEP-200, aka Project Jigsaw, completed in 2017)?

Used it for JavaFX apps with no problems.

Java modules are fine but don’t offer a solution for version conflicts.

Yes custom class loaders can solve this. Eclipse had an entire OSGI module system that did this among other things. In general though Java (and Kotlin) have been trending toward simpler and lighter though for years and I’d recommend just sorting out your dependencies, even drop some, to avoid that kind of thing.

Yes, it's called Java modules (aka JEP-200).

Although people often skip it and put everything in one module. It was released in Java 9 (started in 2014 and completed fully in 2017).

AFAIK Jigsaw solves a different problem. The transitive dep will still be found on the module path.

In some cases, shading can also help. That, basically, renames a classes used in a jar. It has to be done by the creator of the jar, though.

https://stackoverflow.com/a/49811665:

“If your uber JAR is likely to be used as a dependency in another application then there's a risk that the versions of the dependent classes in the uber JAR might clash with versions of those same dependencies in this other application. Shading helps to avoid any such issue by renaming the packages within the uber JAR”

> unless they hand out Guava types to others, of course

You still can hand out guava objects to others, as long as you hand them out as being of a standard Java interface.

That will work as long as the receiver of the type uses instanceof with a class type or reflection, so it is a bit brittle. Technically, any breakage would indicate a bug in the receiving code, but fixing it cleanly may be impossible.

AKA "diamond dependencies"

Java 9 modules address this.

That gets tough with transitive dependencies and the frequent CVEs.

> What about just staying with older version

See grandparent: "dealing with mismatching guava versions brought in as transitive dependencies"

or dealing with the 100 conflicting versions of Guava being pulled in as transitive dependencies.

I dealt with a repo that admitted only one version of each library, so we were stuck with an old version of Guava because it was used all over the place, and upgrading it would have required a lot of refactoring which was not worth anyone's time. One reason to prefer smaller libraries. https://en.wikipedia.org/wiki/Public_goods_game

CVEs are terrible nowadays. Any enterprising ”security researcher” can file one against your project, and the CVE aggregators will flat refuse to take it down. See for example CVE-2023-29827 or CVE-2023-35116

Unfortunately that doesn't prevent "security" from putting checks in the build pipelines.

Does the standard library have a function to parse IP addresses without querying DNS? InetAddresses.forString() was the main reason I used Guava in the past.

InetAddress::getByName

This queries dns in some cases

Not when it’s an IP literal.

What if you don't know if it's an IP literal?

One of the newer things I've appreciated from guava is ListenableFuture to Kotlin suspend functions interop.