java - why javax.annotation of different organization are different -

i'm using guava , jetty in java project, while found odd problem. in guava,it depend javax.annotation has many class while in jetty javax.annotation has less in guava. what's difference between them.

what's more,the javax.annotation in jetty signed,while in guava not signed. when jvm load class package javax.annotation in guava.jar , jetty.jar,it throw securityexception cause 1 package signed , others not signed.

so,what's real difference of javax.annotation package between guava.jar , jetty.jar.

the package in guava: no sign , has lot of class

the package in jetty: signed , has little class

there different libraries provide types in javax.annotations package. 1 guava using jar (now abandoned) jsr-305 proposal. in maven com.google.code.findbugs:jsr305:1.3.9.

the other jar appears org.eclipse.jetty.orbit:javax.annotation:1.1.0.v201108011116. it's not clear jar comes from, , appears have been uploaded in 2011 , never updated since.

the conflict between these 2 jars appears a well-known one.

it appears "dependency" on jar added in guava release 13, release notes version say:

made findbugs provided dependency avert dep conflicts when using findbugs 2.0. side-effect of change projects relied upon guava grant access jsr-305 annotations "for free" break unless provide own direct dependency on jar (or equivalent). projects should have been directly depending on jsr-305 (per maven best-practice), change makes should must.

because of this, understand, guava doesn't have dependency on com.google.code.findbugs:jsr305:1.3.9 jar. should free exclude dependency , provide own javax.annotations jar use instead. alternatively, if prefer com.google.code.findbugs:jsr305 jar, should exclude org.eclipse.jetty.orbit:javax.annotation dependency build. can refer maven documentation how exclude unwanted dependency.