Feature request: Dates and version counts

[losmurfs]

The purpose of this feature is to make it easier to spot libraries that are no longer being maintained and therefore might need to consider replacing and also spot libraries that are further behind than others and therefore may require prioritization as far as upgrading. Here is an example of how the output with the new feature might look (json version):

{
    "current": {
        "dependencies": [{
                "group": "com.fasterxml.jackson.core",
                "userReason": null,
                "version": "2.1.4",
                "released": "Feb 15, 2013",
                "versionsBehind": 86,
                "projectUrl": "http://wiki.fasterxml.com/JacksonHome",
                "name": "jackson-annotations"
            },
            ...
    "gradle": {
        "current": {
            "version": "7.3",
             "released": "Nov 15, 2021",
             "versionsBehind": 0,
            "reason": "",
            "isUpdateAvailable": true,
            "isFailure": false
        },
        ...
        "running": {
            "version": "6.8",
            "released": "Jan 08, 2021",
            "versionsBehind": 12,
            "reason": "",
            "isUpdateAvailable": false,
            "isFailure": false
        }
        ...
    "outdated": {
        "dependencies": [
            {
                "group": "com.braintreepayments.gateway",
                "available": {
                    "release": "3.13.0",
                    "released": "Nov 09, 2021",
                    "versionsBehind": 0,
                    "milestone": null,
                    "integration": null
                },
                "userReason": null,
                "version": "3.12.0",
                    "released": "Jul 15, 2021",
                    "versionsBehind": 1,
                "projectUrl": "https://www.braintreegateway.com",
                "name": "braintree-java"
            },
...

[ben-manes]

I believe this is the same as #398, but unfortunately we couldn't find a good way to capture that.

• We would want to not tie it to a repository like Maven Central, since dependencies can come from anywhere.
• The maven-metadata.xml includes a generic lastUpdated field (example) but that does not tie to a version. A resolution strategy might reject a later version or a patch backported, so assuming it matches the report's version would be wrong.
• The file timestamp seems iffy because the repository might act as a cache rather than the originator (as JCenter did for Maven Central).
• Maven's pom (example) and Gradle's module (example) release descriptors don't include the date, either.

Unfortunately if it is not captured reliably during release then I don't think we can reliably infer it.

[losmurfs]

Thanks, but this feature would not be for concrete decision making, it would be for making things stand out that might not otherwise, let's face it: the date being in accurate would be an edge case, not requesting that date drives logic, but instead date is reported as extra data for decision making: If the latest version says it is from 2005, likely a dead project or project has moved to a new groupId or artifactId has changed. This info cannot be relied on but would help developers notice a neglected library in a large project that they might not otherwise notice.

…

On Fri, Nov 19, 2021 at 10:58 AM Ben Manes ***@***.***> wrote: I believe this is the same as #398 <#398>, but unfortunately we couldn't find a good way to capture that. - We would want to not tie it to a repository like Maven Central, since dependencies can come from anywhere. - The maven-metadata.xml includes a generic lastUpdated field (example <https://repo1.maven.org/maven2/com/github/ben-manes/caffeine/caffeine/maven-metadata.xml>) but that does not tie to a version. A resolution strategy might reject a later version or a patch backported, so assuming it matches the report's version would be wrong. - The file timestamp seems iffy because the repository might act as a cache rather than the originator (as JCenter did for Maven Central). - Maven's pom (example <https://repo1.maven.org/maven2/com/github/ben-manes/caffeine/caffeine/3.0.4/caffeine-3.0.4.pom>) and Gradle's module (example <https://repo1.maven.org/maven2/com/github/ben-manes/caffeine/caffeine/3.0.4/caffeine-3.0.4.module>) release descriptors don't include the date, either. Unfortunately if it is not captured reliably during release then I don't think we can reliably infer it. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#572 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACNQJ4LZZFBI4CWMVSTB3Z3UM2F3LANCNFSM5IMTPNXA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[ben-manes]

Perhaps a plugin dedicated to that goal would be a better option. You could work with these authors to see if all of your features could be met. /cc @mroeppis

https://github.com/mgm-tp/gradle-libactivity-plugin

[losmurfs]

Thanks

…

On Sat, Nov 20, 2021 at 2:24 PM Ben Manes ***@***.***> wrote: Perhaps a plugin dedicated to that goal would be a better option. You could work with these authors to see if all of your features could be met. /cc @mroeppis <https://github.com/mroeppis> https://github.com/mgm-tp/gradle-libactivity-plugin — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#572 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACNQJ4NKZLXK3NQNRMAZEWDUNAGXXANCNFSM5IMTPNXA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.