Choosing and Using Open Source Libraries

How to Pick a Library

• Activity - is it still maintained? Check commits and releases in the last year.
• License - MIT/Apache are permissive; GPL can affect commercial distribution.
• Popularity - more users means more bugs found and fixed and more answers online.
• API quality - read the Javadocs and a sample before committing.

Dependency Hygiene

// Always pin real versions
implementation "com.itextpdf:itext7-core:7.2.5"   // good
integration project(libs.versions.toml)          // use a version catalog

• Avoid SNAPSHOT builds in production.
• Use a BOM or version catalog so transitive versions stay compatible.
• Run dependency analysis tools (OWASP dependency-check, Gradle dependencies report).

Mixing Libraries Gracefully

The libraries in this tutorial combine well: Quartz fires a job that builds a JFreeChart and writes a PDF with iText, while logging with Logback records every step and JavaMail delivers the report. Because all of them are small, focused tools, they integrate through plain Java rather than through each other.

Key Points

• Prefer small, focused, well-licensed libraries.
• Pin versions and run a vulnerability scan.
• Program against stable APIs (SLF4J over Log4j, jakarta.mail over raw SMTP) so you can upgrade later.