in a monorepo with well pinned 3rdparty deps, this isn't as large an issue as you might think (all 60k targets at twitter are using a total of ~4 guava versions at this point, and exactly one hadoop version)