+1 makes a lot of sense now Romain Manni-Bucau @rmannibucau <https://x.com/rmannibucau> | .NET Blog <https://dotnetbirdie.github.io/> | Blog <https://rmannibucau.github.io/> | Old Blog <http://rmannibucau.wordpress.com> | Github <https://github.com/rmannibucau> | LinkedIn <https://www.linkedin.com/in/rmannibucau> | Book <https://www.packtpub.com/en-us/product/java-ee-8-high-performance-9781788473064> Javaccino <https://javaccino.dev/> founder (Java/.NET service - contact via linkedin)
Le ven. 4 sept. 2026 à 13:23, Sylwester Lachiewicz <[email protected]> a écrit : > Hi, > > Maven Shared IO was last released as 3.0.0 in December 2015. Since then it > has > had no user traffic at all: of the 45 issues the repository has ever held, > 29 are > the historical JIRA import, 15 come from a code-reading sweep across a > dozen > Maven repositories in July 2026, and one is mine. None is a user reporting > that > the component misbehaved for them. > > It also has no consumers left. No Apache Maven component imports, the last > one that did, dropped the > dependency in 2020 by copying the classes it needed. The two references > that > remain are test-scope only: an integration-test fixture in > maven-assembly-plugin > pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that > imports > nothing from it. Open Source Insights reports three direct dependents on > 3.0.0; > it gives counts and not names, so I cannot say who they are. > > The git history looks more active than that, and I want to be > straightforward > about it rather than have someone find it in the first reply: there are 98 > commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are > Dependabot and most of the rest are fixes for the July sweep. That is a > component being read, not a component being used. > > Finally, the download package has no Maven 4 story. DownloadManager exposes > Wagon in its published API, and DefaultDownloadManager obtains the Wagon, > the > credentials and the proxy from maven-compat's WagonManager, which Maven 4 > does > not have. Fixing that means breaking the published API of a component > nobody > calls. > > I therefore propose that we retire maven-shared-io. > > If this vote is successful I will make one final release, which also ships > the > fixes that have accumulated since 3.0.0, making it clear on the component > site > that it has been retired. After that the source code repository will get > archived, meaning it's read only in the future. > > The process for retiring a component is described here: > https://maven.apache.org/developers/retirement-plan-plugins.html > > The vote is open for 72 hours. > > [ ] +1 Yes, it's about time > [ ] -1 No, because... > > Sylwester >
