Use 2.x version for j2objc-annotations

[sandeepk-veritas]

Guava currently uses 1.3 version for com.google.j2objc.j2objc-annotations

https://github.com/google/guava/blob/0a17f4a429323589396c38d8ce75ca058faa6c64/pom.xml#L278-L282

However, 2.x branch seems to be the one which is regularly maintained (https://github.com/google/j2objc). Though there are no new versions of 1.x branch after 2017 on Maven (https://search.maven.org/artifact/com.google.j2objc/j2objc-annotations).

j2objc-annotations version 1.3 is getting flagged as EOL by our scanner. I would be like to suggest that Guava move to make use of latest 2.x version of j2objc-annotations.

[cpovirk]

Interesting. Do you know if there are 2.x versions available for the annotations? I see the 2.x releases in the GitHub link you provided (e.g., 2.8), but the only j2objc package I've found in Maven Central is the one that stops at 1.3.

[sandeepk-veritas]

@cpovirk No I am not able to see 2.x on Maven. Not sure why it is like that. I have raised a query around the same on their project page now: https://github.com/google/j2objc/issues/1987

[cpovirk]

For now, I don't think there's anything we can do here. But I've subscribed to the j2objc issue, so I should hear about any new releases. And we try to update our dependencies periodically, too, so that's another chance for us to notice a new release.

[rishiraj88]

Thanks for highlighting the dependency version, @sandeepk-veritas

[sandeepk-veritas]

@cpovirk new release 2.8 of j2objc-annotations is now available on Maven Central.

[cpovirk]

I took care of this in https://github.com/google/guava/commit/e57caa05124219b885b651ba40db3bc649202ec2, but I still need to actually make a new release.