Add shaded libraries as dependencies to `-thin` jar about java-server-sdk HOT 2 OPEN

I understand the problem you're describing, and we have been considering dropping snakeyaml for that reason— but, I'm not sure I understand the particular solution you're proposing.

What would be the mechanism for declaring dependencies for the thin jar? As I understand it (and I apologize if I'm missing something obvious; we haven't used multi-jar publications for any purpose other than this SDK, not counting the standard inclusion of source/javadoc jars), Maven does not have a concept of dependencies for a secondary artifact, i.e. one that has a classifier as opposed to being the default jar. The dependencies declared in pom.xml are, by definition, for the primary artifact (the default jar).

from java-server-sdk.

Hi @eli-darkly. Looks like we faced a similar issue.

The project uses Snyk to check dependencies for security vulnerabilities. Currently, we use com.launchdarkly:launchdarkly-java-server-sdk:6.0.5 which depends on the vulnerable snakeyaml:1.32. Nor Snyk nor sbt doesn't see the launchdakly's dependencies. That's why Snyk can't notify us about the vulnerabilities of launchdarkly's dependencies.
Special thanks to the AWS Inspector who somehow found the vulnerable snakeyaml:1.32 in the Docker image.

I've compared launchdarkly's pom.xml in the local cache with the org.liquibase:liquibase-core:4.16.1 one which also depends on snakeyaml. Probably, the issue appears because your package lacks the dependencies section:

    <dependencies>
    ...
        <dependency>
            <groupId>org.yaml</groupId>
            <artifactId>snakeyaml</artifactId>
            <version>1.31</version>
            <scope>compile</scope>
        </dependency>
    ...
    </dependencies>

from java-server-sdk.