Guava Dependency Not Resolved After Updating to Spring Boot 3.4.3

[gautam-pallav]

Summary
After updating from Spring Boot 3.4.2 to 3.4.3, the Guava dependency is not being resolved, resulting in a dependency not found error.

Steps to Reproduce
Update Spring Boot version to 3.4.3 in pom.xml.
Run mvn dependency:tree | grep guava.
Expected Behavior
The Guava dependency should be resolved without any issues.

Actual Behavior
The following error is encountered:

[ERROR] 'dependencies.dependency.version' for com.google.guava:guava:jar is missing. @ line 177, column 15
Environment
Spring Boot version: 3.4.3
Java version: 11
Maven version: 3.6.3
Additional Context
This issue did not occur with Spring Boot 3.4.2. The dependency tree shows the following for Guava:

[INFO] +- com.google.guava:guava:jar:33.3.1-jre:compile
[INFO] | +- com.google.guava:failureaccess:jar:1.0.2:compile
[INFO] | +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile

[snicoll]

@gautam-pallav Spring Boot does not have dependency management for Guava. Your issue is not actionable right now as there's nothing in the report we can use to figure out if that's a Spring Boot issue as you claim. If you want support, please share a small project that works as described with 3.4.2, and fails with 3.4.3.

[gautam-pallav]

@gautam-pallav Spring Boot does not have dependency management for Guava. Your issue is not actionable right now as there's nothing in the report we can use to figure out if that's a Spring Boot issue as you claim. If you want support, please share a small project that works as described with 3.4.2, and fails with 3.4.3.

Thanks for the prompt reply! I believe I've identified the issue.

In Spring Boot 3.4.2, we did not have to explicitly specify the version for Guava because it was included as a transitive dependency through the prometheus-metrics-instrumentation-guava library, version 1.3.5. However, with the update to Spring Boot 3.4.3, we also updated prometheus-metrics-instrumentation-guava to version 1.3.6.

In version 1.3.6, the BOM (Bill of Materials) was updated to exclude Guava, as it was intended only for internal code reuse. This change means that Guava is no longer included as a transitive dependency, and we now need to specify the version explicitly in our pom.xml file.

https://github.com/prometheus/client_java/releases/tag/v1.3.6

[wilkinsona]

It's good to hear that you tracked down the cause of the change. Thanks for letting us know. I've added a noteworthy entry to the changelog for Spring Boot 3.4.3.