Servlet API 2.5 is a compile dependency that breaks web apps

[meltsufin]

The Servlet API should not be included as a compile dependency in google-oauth-client-appengine because it breaks applications that depend on a different version of the Servlet API.

For example, if you try adding the library to https://github.com/spring-guides/gs-spring-boot, the application will fail at startup.

[meltsufin]

@garrettjonesgoogle Have you had a chance to look at this?

[garrettjonesgoogle]

I have not.

[rdayal]

ping - any updates?

[garrettjonesgoogle]

It's a blocking issue for the GA release of google-cloud-java, so we should get to it soon.

[garrettjonesgoogle]

So I looked at the code in google-oauth-client-appengine, and it appears that the entire point of the module is to provide servlets that extend servlet-api, and thus it is tightly coupled with servlet-api at compile time. Thus, the dependency can't just be removed - the whole module would have to be rewritten in a breaking way to support some new kind of model.

I'm assuming that spring-boot depends on an incompatible version of servlet-api. Is that the case, or is there another problem?

[lesv]

https://github.com/google/google-oauth-java-client/blob/dev/google-oauth-client-appengine/pom.xml#L121-L124
Should be: <scope>provided</scope>

In a normal Servlet environment, this is always provided.

[lesv]

Also https://github.com/google/google-oauth-java-client/blob/dev/google-oauth-client-servlet/pom.xml#L100-L103
Should be: <scope>provided</scope>

[meltsufin]

@garrettjonesgoogle I don't think you need to remove the dependency. Just set the scope to provided. The code should still compile.

[lesv]

This has been released.