I think a setter is fine *if* we have a default implementation.  Otherwise, our standard is to use constructor injection for required dependencies (regardless of checkstyle rule)