Hacker News new | ask | show | jobs
by beeboobaa3 755 days ago
> test libraries only

Typically runs during build (unit tests), just like annotation processors.

> compile time only libraries (hello lombok?)

Right, annotation processors. This is what we're discussing.

> transitive dependencies that may not be used during runtime (or run only in rare code paths)

Irrelevant. If they are compromised they will just set themselves up as an SPI and run on JVM start.