Missing `javax.inject.Provider` from `TrackingFileManagerProvider`

[mkoncek]

Affected version

2.0.17

Bug description

After updating to a new version of a dependency maven-resolver-supplier-mvn4 to 2.0.17, our build started to fail due to java.lang.NoClassDefFoundError: javax/inject/Provider.
I did a quick research using Claude Code, here is a snipped of its output:

Here's what happened: PR #1814 ("Provide modern TrackingFileManager"), merged for 2.0.17, introduced a new TrackingFileManagerProvider class that implements javax.inject.Provider. The RepositorySystemSupplier.createTrackingFileManager() method at line 232 references this class, which triggers class loading of javax.inject.Provider even when using the Service Loader (non-DI) path. This is the same category of bug as MRESOLVER-298, but in different code introduced by a different change.

Our build is indeed fixed by adding:

    <dependency>
      <groupId>javax.inject</groupId>
      <artifactId>javax.inject</artifactId>
      <version>1</version>
      <scope>runtime</scope>
    </dependency>

Could you verify this?

[cstamas]

Yes, this is a bug: the core resolver object graph defines javax.inject as optional dependency, and PR #1814 violated this. Sorry for this. This means we need 2.0.18 release.