Hi, Regarding the direct dependents listed on deps.dev for maven-shared-io:3.0.0:
- file-management: Removed the dependency in 3.1.0 by internalizing MessageHolder (current: 3.2.0). - maven-assembly-plugin: Removed the dependency in 3.4.0 by internalizing the locator strategies (current: 3.8.0). - xmllocation-replacer-maven-plugin: Unused dependency; it can simply be removed from their pom.xml. All 330 indirect dependents pull it transitively via older versions of file-management or maven-assembly-plugin. Upgrading these plugins or excluding maven-shared-io eliminates the transitive dependency. Across the Apache Maven project, there are zero production dependencies remaining. The only reference is an isolated IT test fixture in maven-assembly-plugin pinned to 1.1 for reproducing a legacy Maven 2 issue. Best, Sylwester On Fri, Sep 4, 2026 at 7:16 PM Tamás Cservenák <[email protected]> wrote: > +1 > > > https://deps.dev/maven/org.apache.maven.shared%3Amaven-shared-io/3.0.0/dependents > > T > > On Fri, 4 Sept 2026 at 19:09, Michael Osipov <[email protected]> wrote: > > > > +1 > > > > On 2026/09/04 11:23:20 Sylwester Lachiewicz wrote: > > > Hi, > > > > > > Maven Shared IO was last released as 3.0.0 in December 2015. Since > then it > > > has > > > had no user traffic at all: of the 45 issues the repository has ever > held, > > > 29 are > > > the historical JIRA import, 15 come from a code-reading sweep across a > dozen > > > Maven repositories in July 2026, and one is mine. None is a user > reporting > > > that > > > the component misbehaved for them. > > > > > > It also has no consumers left. No Apache Maven component imports, the > last > > > one that did, dropped the > > > dependency in 2020 by copying the classes it needed. The two > references that > > > remain are test-scope only: an integration-test fixture in > > > maven-assembly-plugin > > > pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that > > > imports > > > nothing from it. Open Source Insights reports three direct dependents > on > > > 3.0.0; > > > it gives counts and not names, so I cannot say who they are. > > > > > > The git history looks more active than that, and I want to be > > > straightforward > > > about it rather than have someone find it in the first reply: there > are 98 > > > commits since the 3.0.0 tag, 21 of them this year. Nine of this year's > are > > > Dependabot and most of the rest are fixes for the July sweep. That is a > > > component being read, not a component being used. > > > > > > Finally, the download package has no Maven 4 story. DownloadManager > exposes > > > Wagon in its published API, and DefaultDownloadManager obtains the > Wagon, > > > the > > > credentials and the proxy from maven-compat's WagonManager, which > Maven 4 > > > does > > > not have. Fixing that means breaking the published API of a component > nobody > > > calls. > > > > > > I therefore propose that we retire maven-shared-io. > > > > > > If this vote is successful I will make one final release, which also > ships > > > the > > > fixes that have accumulated since 3.0.0, making it clear on the > component > > > site > > > that it has been retired. After that the source code repository will > get > > > archived, meaning it's read only in the future. > > > > > > The process for retiring a component is described here: > > > https://maven.apache.org/developers/retirement-plan-plugins.html > > > > > > The vote is open for 72 hours. > > > > > > [ ] +1 Yes, it's about time > > > [ ] -1 No, because... > > > > > > Sylwester > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
