declare dependencies

[elharo]

@dennisl

[slachiewicz]

Any reason why we need to declare these dependencies? org.eclipse.sisu.plexus is a transitive dependency from maven plugin API
and with each update to minimum maven.version property someone needs to adjust also this one instead of giving Maven chance to do its job.

[elharo]

If one specifically imports classes from these dependencies, then they should be declared. Relaying on transitive dependencies is brittle. 5 months later I don't recall exactly which classes are imported from where but mvn dependency:analyze will find anything that's not needed.

[dennisl]

I agree with @elharo

[slachiewicz]

thx @dennisl - would you be able to sync the maven version to 3.1.1 as try to confirm that this proposed approach works?

[slachiewicz]

[INFO] --- maven-dependency-plugin:3.1.1:analyze (default-cli) @ maven-filtering ---
[WARNING] Used undeclared dependencies found:
[WARNING]    org.hamcrest:hamcrest:jar:2.2:test
[WARNING]    org.eclipse.aether:aether-api:jar:0.9.0.M2:compile
[WARNING] Unused declared dependencies found:
[WARNING]    org.hamcrest:hamcrest-core:jar:2.2:test

[slachiewicz]

With each minimum Maven upgrade, someone needs to review all deps and update the version of aether to match with that will be delivered by Maven installation. No older, no newer.

[slachiewicz]

real case: GoogleCloudPlatform/cloud-opensource-java#1091