+1 https://deps.dev/maven/org.apache.maven.shared%3Amaven-shared-io/3.0.0/dependents
T On Fri, 4 Sept 2026 at 19:09, Michael Osipov <[email protected]> wrote: > > +1 > > On 2026/09/04 11:23:20 Sylwester Lachiewicz wrote: > > Hi, > > > > Maven Shared IO was last released as 3.0.0 in December 2015. Since then it > > has > > had no user traffic at all: of the 45 issues the repository has ever held, > > 29 are > > the historical JIRA import, 15 come from a code-reading sweep across a dozen > > Maven repositories in July 2026, and one is mine. None is a user reporting > > that > > the component misbehaved for them. > > > > It also has no consumers left. No Apache Maven component imports, the last > > one that did, dropped the > > dependency in 2020 by copying the classes it needed. The two references that > > remain are test-scope only: an integration-test fixture in > > maven-assembly-plugin > > pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that > > imports > > nothing from it. Open Source Insights reports three direct dependents on > > 3.0.0; > > it gives counts and not names, so I cannot say who they are. > > > > The git history looks more active than that, and I want to be > > straightforward > > about it rather than have someone find it in the first reply: there are 98 > > commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are > > Dependabot and most of the rest are fixes for the July sweep. That is a > > component being read, not a component being used. > > > > Finally, the download package has no Maven 4 story. DownloadManager exposes > > Wagon in its published API, and DefaultDownloadManager obtains the Wagon, > > the > > credentials and the proxy from maven-compat's WagonManager, which Maven 4 > > does > > not have. Fixing that means breaking the published API of a component nobody > > calls. > > > > I therefore propose that we retire maven-shared-io. > > > > If this vote is successful I will make one final release, which also ships > > the > > fixes that have accumulated since 3.0.0, making it clear on the component > > site > > that it has been retired. After that the source code repository will get > > archived, meaning it's read only in the future. > > > > The process for retiring a component is described here: > > https://maven.apache.org/developers/retirement-plan-plugins.html > > > > The vote is open for 72 hours. > > > > [ ] +1 Yes, it's about time > > [ ] -1 No, because... > > > > Sylwester > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
