Remove hdrhistogram managed dependency

[philwebb]

We needed to add it to stop a dependency convergence with micrometer but we should look into other options.

Dependency convergence error for org.hdrhistogram:HdrHistogram:2.1.10 paths to dependency are:
+-org.springframework.boot:spring-boot-starter-actuator:2.0.0.BUILD-SNAPSHOT
  +-io.micrometer:micrometer-core:1.0.0-rc.3
    +-org.hdrhistogram:HdrHistogram:2.1.10
and
+-org.springframework.boot:spring-boot-starter-actuator:2.0.0.BUILD-SNAPSHOT
  +-io.micrometer:micrometer-core:1.0.0-rc.3
    +-org.latencyutils:LatencyUtils:2.0.3
      +-org.hdrhistogram:HdrHistogram:2.1.8

[snicoll]

@philwebb there is still a mistmatch now. Micrometer RC5 brings HdrHistogram 2.1.10 and LatencyUtils brings 2.1.8. I don't really know what options you had in mind.

[snicoll]

@jkschneider can you please fix that version inconsistency in micrometer? It looks weird that Spring Boot has to deal with that secondary dependency.

[jkschneider]

I'm not clear what the resolution would be. They simply didn't do a release of LatencyUtils to correspond with HdrHistogram 2.1.10, but they are compatible.

[philwebb]

@jkschneider I guess ideally the hdrhistogram:2.1.8 dependency would be excluded from latencyutils (in the generated POM) since 2.1.10 is the only version supported. Is there a Gradle equivalent of the enforcer rule that we use to check this?

[jkschneider]

@philwebb Done (for Micrometer 1.0.0).

Is there a Gradle equivalent of the enforcer rule that we use to check this?

Probably? Or it would be a really trivial resolution strategy to implement. Opened an issue here spring-attic/spring-release-plugin#2.

[snicoll]

We need #11575