How to manage Guava dependencies during AEM 6.5 LTS upgrade?

Hi all,

I hope you are doing well!

This is continution to 

while upgrading to AEM 6.5 LTS i’m facing challenges with guava library replacement/alternatives.

as per the LTS analyzer guidance, 

“The `15.0.0.0002` bundle version of Guava is no longer available out of the box in AEM 6.5 LTS due to critical security vulnerabilities. Please update and use latest non-vulnerable version of guava.”, so started with using latest versions with no vulnerabilities.

<!-- Source: https://mvnrepository.com/artifact/com.google.guava/guava -->

<dependency>

    <groupId>com.google.guava</groupId>

    <artifactId>guava</artifactId>

    <version>33.5.0-jre</version>

    <scope>compile</scope>

</dependency>

This is working at Java side but not at AEM instance, because there is no such library provided by Adobe runtime, so we need to embed this ourselves in our application generated bundle, this is failed because ‘com.google.guava’ bundle is a multi-release and the issue is  “JAR (like Guava 33.5.0-jre) in your built package. The filevault-package-maven-plugin and FastClasspathScanner cannot handle Java 9+ module-info.class files, resulting in the scan failure”.

So the suggestion was to use lower version + non multi-release bundle with no vulnerabilities, so switched to 

<!-- Source: https://mvnrepository.com/artifact/com.google.guava/guava -->

<dependency>

    <groupId>com.google.guava</groupId>

    <artifactId>guava</artifactId>

    <version>32.0.1-jre</version>

    <scope>compile</scope>

</dependency>

Still failed to embed as this is not OSGI bundle, to make to work tried an approach with ‘maven-shade-plugin’ in POM.xml, but didn’t work.

now, i’m thinking the next steps would be 

1. Make the embed work.
2. Use the wrapper ‘org.apache.servicemix.bundles:org.apache.servicemix.bundles.guava’ (even tried this, but maven somehow failed download the dependency from repo, though that is existed in maven central)
3. Completely migrate away from Guava library

FI:

I’m using:  aem-6.6.1.jar and same uber.jar, uber-apis.jar along with Java 17.

The error:

org.apache.lucene.index.ThreadAffinityDocumentsWriterThreadPool@2f1cd9b3_readerPooling=false_perThreadHardLimitMB=1945_useCompoundFile=true_writer=org.apache.lucene.util.SetOnce@5fe6ea4f_
14.03.2026 02:09:43.961 *ERROR* [qtp1339066269-1825] org.apache.felix.webconsole Cannot start
org.osgi.framework.BundleException: Unable to resolve abc.core [699](R 699.13): missing requirement [abc.core [699](R 699.13)] osgi.wiring.package; (&(osgi.wiring.package=com.google.common.cache)(version>=32.0.0)(!(version>=33.0.0))) [caused by: Unable to resolve com.google.guava [705](R 705.0): missing requirement [com.google.guava [705](R 705.0)] osgi.wiring.package; (&(osgi.wiring.package=com.google.common.util.concurrent.internal)(version>=1.0.0)(!(version>=2.0.0)))] Unresolved requirements: [[abc.core [699](R 699.13)] osgi.wiring.package; (&(osgi.wiring.package=com.google.common.cache)(version>=32.0.0)(!(version>=33.0.0)))]

let me know i’m not on right direction.

Thanks,

Raju.