+1 my search of usage https://github.com/search?q=%22%3CartifactId%3Emaven-shared-io%3C%2FartifactId%3E%22+language%3A%22Maven+POM%22++NOT+is%3Aarchived+NOT+is%3Afork&type=code
On Fri, 4 Sept 2026 at 13:23, Sylwester Lachiewicz <[email protected]> wrote: > > Hi, > > Maven Shared IO was last released as 3.0.0 in December 2015. Since then it > has > had no user traffic at all: of the 45 issues the repository has ever held, > 29 are > the historical JIRA import, 15 come from a code-reading sweep across a dozen > Maven repositories in July 2026, and one is mine. None is a user reporting > that > the component misbehaved for them. > > It also has no consumers left. No Apache Maven component imports, the last > one that did, dropped the > dependency in 2020 by copying the classes it needed. The two references that > remain are test-scope only: an integration-test fixture in > maven-assembly-plugin > pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that > imports > nothing from it. Open Source Insights reports three direct dependents on > 3.0.0; > it gives counts and not names, so I cannot say who they are. > > The git history looks more active than that, and I want to be > straightforward > about it rather than have someone find it in the first reply: there are 98 > commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are > Dependabot and most of the rest are fixes for the July sweep. That is a > component being read, not a component being used. > > Finally, the download package has no Maven 4 story. DownloadManager exposes > Wagon in its published API, and DefaultDownloadManager obtains the Wagon, > the > credentials and the proxy from maven-compat's WagonManager, which Maven 4 > does > not have. Fixing that means breaking the published API of a component nobody > calls. > > I therefore propose that we retire maven-shared-io. > > If this vote is successful I will make one final release, which also ships > the > fixes that have accumulated since 3.0.0, making it clear on the component > site > that it has been retired. After that the source code repository will get > archived, meaning it's read only in the future. > > The process for retiring a component is described here: > https://maven.apache.org/developers/retirement-plan-plugins.html > > The vote is open for 72 hours. > > [ ] +1 Yes, it's about time > [ ] -1 No, because... > > Sylwester -- Sławomir Jaranowski --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
