Dependency governance rules for shenyu client java

[lll-peanut]

fix : #6372

What

Add shenyu-client/DEPENDENCY_GOVERNANCE.md — a comprehensive dependency governance rulebook for the shenyu-client module family, which is published independently as
shenyu-client-java artifacts on Maven Central.

Why

The client artifacts must preserve JDK 8 runtime compatibility even though the main ShenYu repository has moved to JDK 17. Dependency upgrades can accidentally break JDK 8 users or
re-couple the client repo to the main repo upgrade path. This document establishes rules to prevent that.

Contents

Document structure (10 sections + 2 appendices)

Section	Purpose
§1 Overview	Background, scope, relationship to shenyu-client-java repo, JDK 8 first principle
§2 Runtime Dependency Inventory	4 tables covering 30+ runtime dependencies with class version, JDK status, and evidence
§3 Test/Tooling Dependency Inventory	2 tables covering test deps + build plugins
§4 Risky Dependencies Watchlist	6 🔴 Confirmed ceilings, 6 🟡 Monitor items, 8 🟢 Stable deps
§5 Runtime Upgrade Rules	Golden rule + 6 specific rules
§6 Test/Tooling Upgrade Rules	5 rules + permitted upgrade list
§7 Known Exceptions	JaCoCo (§7.1), Byte Buddy (§7.2), SOFA Boot (§7.3), WireMock divergence (§7.4)
§8 PR Verification	3 local checks + 3 CI checks + 4 rejection criteria + PR description template
§9 Upgrade Checklist	14-item copy-paste checklist for contributors
§10 Policy Review Cadence	Quarterly review triggers
Appendix A	Quick-reference version ceiling table
Appendix B	Build verification commands (javap, dependency:tree, class file scan)

Verification methodology

Every dependency claim was verified with three independent sources:

1. JAR bytecode analysis — class file major version checked via unzip -p <jar> <class> | od for 18 artifacts in local Maven cache
2. Official project documentation — WebSearch of release notes, README, and changelogs for 10 cross-version claims
3. POM cross-reference — all 18 version numbers checked against the actual shenyu-client-java repository POMs

Key findings documented

• 6 confirmed JDK 8 ceilings: OkHttp (5.x), Mockito (5.x), Caffeine (3.x), WireMock (3.x), Spring Framework (6.x), JAXB namespace (jakarta.xml.bind 3.x)
• 4 previously incorrect claims corrected during verification: Guava (no ceiling yet, #6549 still open), Gson (3.0 doesn't exist), Swagger Core (3.x doesn't exist), JaCoCo (0.9.x
  doesn't exist)

---

Make sure that:

• You have read the contribution guidelines.
• You submit test cases (unit or integration tests) that back your changes.
• Your local test passed ./mvnw clean install -Dmaven.javadoc.skip=true.