- Looks like if plain deps are not defined as constraints test deps will leak into a fatjar build i.e. with sample. - Change it how its done in spring security where this idea was taken. - Remove use of maven-publish plugin which is not needed. - Relates #470