remove guava dependencies

[guwirth]

• remove GUAVA dependencies
• lint: update org.sonarsource.sonarqube:sonar-check-api to 6.7
• update sslr-xpath to 1.23
• keep GUAVA dependency for AnnotationBasedRulesDefinition
• optimize POMs
• smaller JAR

This change is 

[guwirth]

squidbridge 2.6.1 still needs GUAVA

java.lang.NoClassDefFoundError: com/google/common/collect/Iterables
	at org.sonar.squidbridge.annotations.AnnotationBasedRulesDefinition.addRuleClasses(AnnotationBasedRulesDefinition.java:90)
	at org.sonar.squidbridge.annotations.AnnotationBasedRulesDefinition.addRuleClasses(AnnotationBasedRulesDefinition.java:86)
	at org.sonar.plugins.cxx.CxxRuleRepository.define(CxxRuleRepository.java:40)

[guwirth]

@ivangalkin like to merge this next. Please have a look.

[ivangalkin]

Reviewed 24 of 25 files at r1.
Reviewable status: all files reviewed, 6 unresolved discussions (waiting on @guwirth, @jmecosta, and @Bertk)

---

pom.xml, line 286 at r2 (raw file):

 <exclusion>

unrelated to your change:

do you know, which version of sslr-core does the current sslr-squid-bridge depends on? is there a huge gap between the one, which sslr-squid-brige requires and the one, we use?

I'm afraid, that at some point in time we'll be forced to fork the sslr-squid-bridge in order to preserve the check/preprocessor infrastructure at the one hand and to have the newest sslr-core on the other

---

pom.xml, line 289 at r2 (raw file):

·······

trailing whitespaces

---

cxx-sensors/src/main/java/org/sonar/cxx/sensors/visitors/CxxFileLinesVisitor.java, line 238 at r2 (raw file):

new HashSet(...)

such syntax creates a warning like "HashSet is a raw type. References to generic type HashSet should be parameterized" aka "rawtypes".
I believe you should write...

new HashSet<>(...)

...instead

---

cxx-squid/src/main/java/org/sonar/cxx/preprocessor/CxxPreprocessor.java, line 441 at r2 (raw file):

new HashSet<>()

please use Collections.emptySet() instead, which doesn't allocate buckets (Collections.<Include>emptySet() might be required, not sure)

---

sonar-cxx-plugin/pom.xml, line 55 at r2 (raw file):

·

trailing whitespace

---

sonar-cxx-plugin/src/main/java/org/sonar/plugins/cxx/CxxPlugin.java, line 457 at r2 (raw file):

new ArrayList<>(Arrays.asList(...))

not sure if it makes much sense: SonarQube forces to copy internal containers (or to protect them as Collections.unmodifiable*()) in order to prevent the modification of these container from the outside. Here we don't have any risk of exposing any states. We return a temporary.

[guwirth]

@ivangalkin

do you know, which version of sslr-core does the current sslr-squid-bridge depends on?

Don' know. But maybe you can find it out here:
https://mvnrepository.com/artifact/org.sonarsource.sslr/sslr-core/usages

[guwirth]

@ivangalkin

please use Collections.emptySet() instead, which doesn't allocate buckets (Collections.emptySet() might be required, not sure)

Both does not work