...

• provided dependencies should be used only for APIs which are supplied by the run-time container.
• compile dependencies should be used for all other modules whose APIs are referenced by the source code.
• If a compile dependency is used by optional code in a project like java-support, the dependency should be compile but marked as optional. Client projects which require the optional functionality must manually include the missing transitive dependency with runtime scope if they do not already require it at compile scope.
• If a module is required to be present at run time but is not referenced by the source code, it is a runtime scope dependency.
• If a module is not required by the main source code but is required for testing, it is a test scope dependency.

Dependency updates

tbd.  The Dependencies can be updated when new versions become available during development. It is also sensible to perform a check for dependency updates of which we are not otherwise aware prior to a release.

To review the available dependency updates in a particular context (either the parent POM or a subordinate project which defines its own dependencies not managed by the parent project) the command of interest is:

mvn versions:display-dependency-updates

...

Obviously critical subsystems (XML handling, beans, encoders) need further discussion.

As of 2020-01-30, for the Java 11 platform, the following exceptions can be noted:

ch.qos.logback:*

com.sun.activation:jakarta.activation

commons-collections:commons-collections

jakarta.activation:jakarta.activation-api

jakarta.json:jakarta.json-api

javax.servlet:javax.servlet-api

org.glassfish:jakarta.json

org.glassfish.jaxb:jaxb-runtime

org.hibernate:hibernate-core

org.ldaptive:ldaptive

org.slf4j:*

Plugin Maintenance

The simplest way to find what is out of date is to run 

...