I think at some places (twitter?) they sometimes take such jars and repackage them without their deps and upload them to their private nexus/artifactory with a new version,.