You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@maven.apache.org by Sylwester Lachiewicz <sl...@gmail.com> on 2026/09/04 11:23:20 UTC
[VOTE] Retire Maven Shared IO
Hi,
Maven Shared IO was last released as 3.0.0 in December 2015. Since then it
has
had no user traffic at all: of the 45 issues the repository has ever held,
29 are
the historical JIRA import, 15 come from a code-reading sweep across a dozen
Maven repositories in July 2026, and one is mine. None is a user reporting
that
the component misbehaved for them.
It also has no consumers left. No Apache Maven component imports, the last
one that did, dropped the
dependency in 2020 by copying the classes it needed. The two references that
remain are test-scope only: an integration-test fixture in
maven-assembly-plugin
pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
imports
nothing from it. Open Source Insights reports three direct dependents on
3.0.0;
it gives counts and not names, so I cannot say who they are.
The git history looks more active than that, and I want to be
straightforward
about it rather than have someone find it in the first reply: there are 98
commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are
Dependabot and most of the rest are fixes for the July sweep. That is a
component being read, not a component being used.
Finally, the download package has no Maven 4 story. DownloadManager exposes
Wagon in its published API, and DefaultDownloadManager obtains the Wagon,
the
credentials and the proxy from maven-compat's WagonManager, which Maven 4
does
not have. Fixing that means breaking the published API of a component nobody
calls.
I therefore propose that we retire maven-shared-io.
If this vote is successful I will make one final release, which also ships
the
fixes that have accumulated since 3.0.0, making it clear on the component
site
that it has been retired. After that the source code repository will get
archived, meaning it's read only in the future.
The process for retiring a component is described here:
https://maven.apache.org/developers/retirement-plan-plugins.html
The vote is open for 72 hours.
[ ] +1 Yes, it's about time
[ ] -1 No, because...
Sylwester
Re: [VOTE] Retire Maven Shared IO
Posted by Maarten Mulders <mt...@apache.org>.
+1
- Maarten
On September 4, 2026 at 13:23, Sylwester Lachiewicz wrote:
> Hi,
>
> Maven Shared IO was last released as 3.0.0 in December 2015. Since then it
> has
> had no user traffic at all: of the 45 issues the repository has ever held,
> 29 are
> the historical JIRA import, 15 come from a code-reading sweep across a dozen
> Maven repositories in July 2026, and one is mine. None is a user reporting
> that
> the component misbehaved for them.
>
> It also has no consumers left. No Apache Maven component imports, the last
> one that did, dropped the
> dependency in 2020 by copying the classes it needed. The two references that
> remain are test-scope only: an integration-test fixture in
> maven-assembly-plugin
> pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> imports
> nothing from it. Open Source Insights reports three direct dependents on
> 3.0.0;
> it gives counts and not names, so I cannot say who they are.
>
> The git history looks more active than that, and I want to be
> straightforward
> about it rather than have someone find it in the first reply: there are 98
> commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are
> Dependabot and most of the rest are fixes for the July sweep. That is a
> component being read, not a component being used.
>
> Finally, the download package has no Maven 4 story. DownloadManager exposes
> Wagon in its published API, and DefaultDownloadManager obtains the Wagon,
> the
> credentials and the proxy from maven-compat's WagonManager, which Maven 4
> does
> not have. Fixing that means breaking the published API of a component nobody
> calls.
>
> I therefore propose that we retire maven-shared-io.
>
> If this vote is successful I will make one final release, which also ships
> the
> fixes that have accumulated since 3.0.0, making it clear on the component
> site
> that it has been retired. After that the source code repository will get
> archived, meaning it's read only in the future.
>
> The process for retiring a component is described here:
> https://maven.apache.org/developers/retirement-plan-plugins.html
>
> The vote is open for 72 hours.
>
> [ ] +1 Yes, it's about time
> [ ] -1 No, because...
>
> Sylwester
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: [VOTE] Retire Maven Shared IO
Posted by Romain Manni-Bucau <rm...@gmail.com>.
+1 makes a lot of sense now
Romain Manni-Bucau
@rmannibucau <https://x.com/rmannibucau> | .NET Blog
<https://dotnetbirdie.github.io/> | Blog <https://rmannibucau.github.io/> | Old
Blog <http://rmannibucau.wordpress.com> | Github
<https://github.com/rmannibucau> | LinkedIn
<https://www.linkedin.com/in/rmannibucau> | Book
<https://www.packtpub.com/en-us/product/java-ee-8-high-performance-9781788473064>
Javaccino <https://javaccino.dev/> founder (Java/.NET service - contact via
linkedin)
Le ven. 4 sept. 2026 à 13:23, Sylwester Lachiewicz <sl...@gmail.com>
a écrit :
> Hi,
>
> Maven Shared IO was last released as 3.0.0 in December 2015. Since then it
> has
> had no user traffic at all: of the 45 issues the repository has ever held,
> 29 are
> the historical JIRA import, 15 come from a code-reading sweep across a
> dozen
> Maven repositories in July 2026, and one is mine. None is a user reporting
> that
> the component misbehaved for them.
>
> It also has no consumers left. No Apache Maven component imports, the last
> one that did, dropped the
> dependency in 2020 by copying the classes it needed. The two references
> that
> remain are test-scope only: an integration-test fixture in
> maven-assembly-plugin
> pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> imports
> nothing from it. Open Source Insights reports three direct dependents on
> 3.0.0;
> it gives counts and not names, so I cannot say who they are.
>
> The git history looks more active than that, and I want to be
> straightforward
> about it rather than have someone find it in the first reply: there are 98
> commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are
> Dependabot and most of the rest are fixes for the July sweep. That is a
> component being read, not a component being used.
>
> Finally, the download package has no Maven 4 story. DownloadManager exposes
> Wagon in its published API, and DefaultDownloadManager obtains the Wagon,
> the
> credentials and the proxy from maven-compat's WagonManager, which Maven 4
> does
> not have. Fixing that means breaking the published API of a component
> nobody
> calls.
>
> I therefore propose that we retire maven-shared-io.
>
> If this vote is successful I will make one final release, which also ships
> the
> fixes that have accumulated since 3.0.0, making it clear on the component
> site
> that it has been retired. After that the source code repository will get
> archived, meaning it's read only in the future.
>
> The process for retiring a component is described here:
> https://maven.apache.org/developers/retirement-plan-plugins.html
>
> The vote is open for 72 hours.
>
> [ ] +1 Yes, it's about time
> [ ] -1 No, because...
>
> Sylwester
>
Re: [VOTE] Retire Maven Shared IO
Posted by Elliotte Rusty Harold <el...@ibiblio.org>.
On Fri, Sep 4, 2026 at 7:23 AM Sylwester Lachiewicz
<sl...@gmail.com> wrote:
>
> It also has no consumers left. No Apache Maven component imports, the last
> one that did, dropped the
> dependency in 2020 by copying the classes it needed. The two references that
> remain are test-scope only: an integration-test fixture in
> maven-assembly-plugin
> pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> imports
> nothing from it. Open Source Insights reports three direct dependents on
> 3.0.0;
> it gives counts and not names, so I cannot say who they are.
>
Is the maven-assembly-plugin reference something we can fix?
I don't know anything about jackrabbit but maybe we can send a patch
to remove that?
--
Elliotte Rusty Harold
elharo@ibiblio.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Retire Maven Shared IO
Posted by Sylwester Lachiewicz <sl...@gmail.com>.
Hi,
Regarding the direct dependents listed on deps.dev for
maven-shared-io:3.0.0:
- file-management: Removed the dependency in 3.1.0 by internalizing
MessageHolder (current: 3.2.0).
- maven-assembly-plugin: Removed the dependency in 3.4.0 by internalizing
the locator strategies (current: 3.8.0).
- xmllocation-replacer-maven-plugin: Unused dependency; it can simply be
removed from their pom.xml.
All 330 indirect dependents pull it transitively via older versions of
file-management or maven-assembly-plugin. Upgrading these plugins or
excluding maven-shared-io eliminates the transitive dependency.
Across the Apache Maven project, there are zero production dependencies
remaining. The only reference is an isolated IT test fixture in
maven-assembly-plugin pinned to 1.1 for reproducing a legacy Maven 2 issue.
Best,
Sylwester
On Fri, Sep 4, 2026 at 7:16 PM Tamás Cservenák <ta...@cservenak.net> wrote:
> +1
>
>
> https://deps.dev/maven/org.apache.maven.shared%3Amaven-shared-io/3.0.0/dependents
>
> T
>
> On Fri, 4 Sept 2026 at 19:09, Michael Osipov <mi...@apache.org> wrote:
> >
> > +1
> >
> > On 2026/09/04 11:23:20 Sylwester Lachiewicz wrote:
> > > Hi,
> > >
> > > Maven Shared IO was last released as 3.0.0 in December 2015. Since
> then it
> > > has
> > > had no user traffic at all: of the 45 issues the repository has ever
> held,
> > > 29 are
> > > the historical JIRA import, 15 come from a code-reading sweep across a
> dozen
> > > Maven repositories in July 2026, and one is mine. None is a user
> reporting
> > > that
> > > the component misbehaved for them.
> > >
> > > It also has no consumers left. No Apache Maven component imports, the
> last
> > > one that did, dropped the
> > > dependency in 2020 by copying the classes it needed. The two
> references that
> > > remain are test-scope only: an integration-test fixture in
> > > maven-assembly-plugin
> > > pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> > > imports
> > > nothing from it. Open Source Insights reports three direct dependents
> on
> > > 3.0.0;
> > > it gives counts and not names, so I cannot say who they are.
> > >
> > > The git history looks more active than that, and I want to be
> > > straightforward
> > > about it rather than have someone find it in the first reply: there
> are 98
> > > commits since the 3.0.0 tag, 21 of them this year. Nine of this year's
> are
> > > Dependabot and most of the rest are fixes for the July sweep. That is a
> > > component being read, not a component being used.
> > >
> > > Finally, the download package has no Maven 4 story. DownloadManager
> exposes
> > > Wagon in its published API, and DefaultDownloadManager obtains the
> Wagon,
> > > the
> > > credentials and the proxy from maven-compat's WagonManager, which
> Maven 4
> > > does
> > > not have. Fixing that means breaking the published API of a component
> nobody
> > > calls.
> > >
> > > I therefore propose that we retire maven-shared-io.
> > >
> > > If this vote is successful I will make one final release, which also
> ships
> > > the
> > > fixes that have accumulated since 3.0.0, making it clear on the
> component
> > > site
> > > that it has been retired. After that the source code repository will
> get
> > > archived, meaning it's read only in the future.
> > >
> > > The process for retiring a component is described here:
> > > https://maven.apache.org/developers/retirement-plan-plugins.html
> > >
> > > The vote is open for 72 hours.
> > >
> > > [ ] +1 Yes, it's about time
> > > [ ] -1 No, because...
> > >
> > > Sylwester
> > >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
Re: [VOTE] Retire Maven Shared IO
Posted by Tamás Cservenák <ta...@cservenak.net>.
+1
https://deps.dev/maven/org.apache.maven.shared%3Amaven-shared-io/3.0.0/dependents
T
On Fri, 4 Sept 2026 at 19:09, Michael Osipov <mi...@apache.org> wrote:
>
> +1
>
> On 2026/09/04 11:23:20 Sylwester Lachiewicz wrote:
> > Hi,
> >
> > Maven Shared IO was last released as 3.0.0 in December 2015. Since then it
> > has
> > had no user traffic at all: of the 45 issues the repository has ever held,
> > 29 are
> > the historical JIRA import, 15 come from a code-reading sweep across a dozen
> > Maven repositories in July 2026, and one is mine. None is a user reporting
> > that
> > the component misbehaved for them.
> >
> > It also has no consumers left. No Apache Maven component imports, the last
> > one that did, dropped the
> > dependency in 2020 by copying the classes it needed. The two references that
> > remain are test-scope only: an integration-test fixture in
> > maven-assembly-plugin
> > pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> > imports
> > nothing from it. Open Source Insights reports three direct dependents on
> > 3.0.0;
> > it gives counts and not names, so I cannot say who they are.
> >
> > The git history looks more active than that, and I want to be
> > straightforward
> > about it rather than have someone find it in the first reply: there are 98
> > commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are
> > Dependabot and most of the rest are fixes for the July sweep. That is a
> > component being read, not a component being used.
> >
> > Finally, the download package has no Maven 4 story. DownloadManager exposes
> > Wagon in its published API, and DefaultDownloadManager obtains the Wagon,
> > the
> > credentials and the proxy from maven-compat's WagonManager, which Maven 4
> > does
> > not have. Fixing that means breaking the published API of a component nobody
> > calls.
> >
> > I therefore propose that we retire maven-shared-io.
> >
> > If this vote is successful I will make one final release, which also ships
> > the
> > fixes that have accumulated since 3.0.0, making it clear on the component
> > site
> > that it has been retired. After that the source code repository will get
> > archived, meaning it's read only in the future.
> >
> > The process for retiring a component is described here:
> > https://maven.apache.org/developers/retirement-plan-plugins.html
> >
> > The vote is open for 72 hours.
> >
> > [ ] +1 Yes, it's about time
> > [ ] -1 No, because...
> >
> > Sylwester
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: [VOTE] Retire Maven Shared IO
Posted by Michael Osipov <mi...@apache.org>.
+1
On 2026/09/04 11:23:20 Sylwester Lachiewicz wrote:
> Hi,
>
> Maven Shared IO was last released as 3.0.0 in December 2015. Since then it
> has
> had no user traffic at all: of the 45 issues the repository has ever held,
> 29 are
> the historical JIRA import, 15 come from a code-reading sweep across a dozen
> Maven repositories in July 2026, and one is mine. None is a user reporting
> that
> the component misbehaved for them.
>
> It also has no consumers left. No Apache Maven component imports, the last
> one that did, dropped the
> dependency in 2020 by copying the classes it needed. The two references that
> remain are test-scope only: an integration-test fixture in
> maven-assembly-plugin
> pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> imports
> nothing from it. Open Source Insights reports three direct dependents on
> 3.0.0;
> it gives counts and not names, so I cannot say who they are.
>
> The git history looks more active than that, and I want to be
> straightforward
> about it rather than have someone find it in the first reply: there are 98
> commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are
> Dependabot and most of the rest are fixes for the July sweep. That is a
> component being read, not a component being used.
>
> Finally, the download package has no Maven 4 story. DownloadManager exposes
> Wagon in its published API, and DefaultDownloadManager obtains the Wagon,
> the
> credentials and the proxy from maven-compat's WagonManager, which Maven 4
> does
> not have. Fixing that means breaking the published API of a component nobody
> calls.
>
> I therefore propose that we retire maven-shared-io.
>
> If this vote is successful I will make one final release, which also ships
> the
> fixes that have accumulated since 3.0.0, making it clear on the component
> site
> that it has been retired. After that the source code repository will get
> archived, meaning it's read only in the future.
>
> The process for retiring a component is described here:
> https://maven.apache.org/developers/retirement-plan-plugins.html
>
> The vote is open for 72 hours.
>
> [ ] +1 Yes, it's about time
> [ ] -1 No, because...
>
> Sylwester
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: [VOTE] Retire Maven Shared IO
Posted by Slawomir Jaranowski <s....@gmail.com>.
+1
my search of usage
https://github.com/search?q=%22%3CartifactId%3Emaven-shared-io%3C%2FartifactId%3E%22+language%3A%22Maven+POM%22++NOT+is%3Aarchived+NOT+is%3Afork&type=code
On Fri, 4 Sept 2026 at 13:23, Sylwester Lachiewicz
<sl...@gmail.com> wrote:
>
> Hi,
>
> Maven Shared IO was last released as 3.0.0 in December 2015. Since then it
> has
> had no user traffic at all: of the 45 issues the repository has ever held,
> 29 are
> the historical JIRA import, 15 come from a code-reading sweep across a dozen
> Maven repositories in July 2026, and one is mine. None is a user reporting
> that
> the component misbehaved for them.
>
> It also has no consumers left. No Apache Maven component imports, the last
> one that did, dropped the
> dependency in 2020 by copying the classes it needed. The two references that
> remain are test-scope only: an integration-test fixture in
> maven-assembly-plugin
> pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> imports
> nothing from it. Open Source Insights reports three direct dependents on
> 3.0.0;
> it gives counts and not names, so I cannot say who they are.
>
> The git history looks more active than that, and I want to be
> straightforward
> about it rather than have someone find it in the first reply: there are 98
> commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are
> Dependabot and most of the rest are fixes for the July sweep. That is a
> component being read, not a component being used.
>
> Finally, the download package has no Maven 4 story. DownloadManager exposes
> Wagon in its published API, and DefaultDownloadManager obtains the Wagon,
> the
> credentials and the proxy from maven-compat's WagonManager, which Maven 4
> does
> not have. Fixing that means breaking the published API of a component nobody
> calls.
>
> I therefore propose that we retire maven-shared-io.
>
> If this vote is successful I will make one final release, which also ships
> the
> fixes that have accumulated since 3.0.0, making it clear on the component
> site
> that it has been retired. After that the source code repository will get
> archived, meaning it's read only in the future.
>
> The process for retiring a component is described here:
> https://maven.apache.org/developers/retirement-plan-plugins.html
>
> The vote is open for 72 hours.
>
> [ ] +1 Yes, it's about time
> [ ] -1 No, because...
>
> Sylwester
--
Sławomir Jaranowski
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: [VOTE] Retire Maven Shared IO
Posted by Elliotte Rusty Harold <el...@ibiblio.org>.
On Fri, Sep 4, 2026 at 7:23 AM Sylwester Lachiewicz
<sl...@gmail.com> wrote:
>
> It also has no consumers left. No Apache Maven component imports, the last
> one that did, dropped the
> dependency in 2020 by copying the classes it needed. The two references that
> remain are test-scope only: an integration-test fixture in
> maven-assembly-plugin
> pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> imports
> nothing from it. Open Source Insights reports three direct dependents on
> 3.0.0;
> it gives counts and not names, so I cannot say who they are.
>
Is the maven-assembly-plugin reference something we can fix?
I don't know anything about jackrabbit but maybe we can send a patch
to remove that?
--
Elliotte Rusty Harold
elharo@ibiblio.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: [VOTE] Retire Maven Shared IO
Posted by Elliotte Rusty Harold <el...@ibiblio.org>.
+1
On Fri, Sep 4, 2026 at 11:23 AM Sylwester Lachiewicz
<sl...@gmail.com> wrote:
>
> Hi,
>
> Maven Shared IO was last released as 3.0.0 in December 2015. Since then it
> has
> had no user traffic at all: of the 45 issues the repository has ever held,
> 29 are
> the historical JIRA import, 15 come from a code-reading sweep across a dozen
> Maven repositories in July 2026, and one is mine. None is a user reporting
> that
> the component misbehaved for them.
>
> It also has no consumers left. No Apache Maven component imports, the last
> one that did, dropped the
> dependency in 2020 by copying the classes it needed. The two references that
> remain are test-scope only: an integration-test fixture in
> maven-assembly-plugin
> pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> imports
> nothing from it. Open Source Insights reports three direct dependents on
> 3.0.0;
> it gives counts and not names, so I cannot say who they are.
>
> The git history looks more active than that, and I want to be
> straightforward
> about it rather than have someone find it in the first reply: there are 98
> commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are
> Dependabot and most of the rest are fixes for the July sweep. That is a
> component being read, not a component being used.
>
> Finally, the download package has no Maven 4 story. DownloadManager exposes
> Wagon in its published API, and DefaultDownloadManager obtains the Wagon,
> the
> credentials and the proxy from maven-compat's WagonManager, which Maven 4
> does
> not have. Fixing that means breaking the published API of a component nobody
> calls.
>
> I therefore propose that we retire maven-shared-io.
>
> If this vote is successful I will make one final release, which also ships
> the
> fixes that have accumulated since 3.0.0, making it clear on the component
> site
> that it has been retired. After that the source code repository will get
> archived, meaning it's read only in the future.
>
> The process for retiring a component is described here:
> https://maven.apache.org/developers/retirement-plan-plugins.html
>
> The vote is open for 72 hours.
>
> [ ] +1 Yes, it's about time
> [ ] -1 No, because...
>
> Sylwester
--
Elliotte Rusty Harold
elharo@ibiblio.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: [VOTE] Retire Maven Shared IO
Posted by Romain Manni-Bucau <rm...@gmail.com>.
+1 makes a lot of sense now
Romain Manni-Bucau
@rmannibucau <https://x.com/rmannibucau> | .NET Blog
<https://dotnetbirdie.github.io/> | Blog <https://rmannibucau.github.io/> | Old
Blog <http://rmannibucau.wordpress.com> | Github
<https://github.com/rmannibucau> | LinkedIn
<https://www.linkedin.com/in/rmannibucau> | Book
<https://www.packtpub.com/en-us/product/java-ee-8-high-performance-9781788473064>
Javaccino <https://javaccino.dev/> founder (Java/.NET service - contact via
linkedin)
Le ven. 4 sept. 2026 à 13:23, Sylwester Lachiewicz <sl...@gmail.com>
a écrit :
> Hi,
>
> Maven Shared IO was last released as 3.0.0 in December 2015. Since then it
> has
> had no user traffic at all: of the 45 issues the repository has ever held,
> 29 are
> the historical JIRA import, 15 come from a code-reading sweep across a
> dozen
> Maven repositories in July 2026, and one is mine. None is a user reporting
> that
> the component misbehaved for them.
>
> It also has no consumers left. No Apache Maven component imports, the last
> one that did, dropped the
> dependency in 2020 by copying the classes it needed. The two references
> that
> remain are test-scope only: an integration-test fixture in
> maven-assembly-plugin
> pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> imports
> nothing from it. Open Source Insights reports three direct dependents on
> 3.0.0;
> it gives counts and not names, so I cannot say who they are.
>
> The git history looks more active than that, and I want to be
> straightforward
> about it rather than have someone find it in the first reply: there are 98
> commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are
> Dependabot and most of the rest are fixes for the July sweep. That is a
> component being read, not a component being used.
>
> Finally, the download package has no Maven 4 story. DownloadManager exposes
> Wagon in its published API, and DefaultDownloadManager obtains the Wagon,
> the
> credentials and the proxy from maven-compat's WagonManager, which Maven 4
> does
> not have. Fixing that means breaking the published API of a component
> nobody
> calls.
>
> I therefore propose that we retire maven-shared-io.
>
> If this vote is successful I will make one final release, which also ships
> the
> fixes that have accumulated since 3.0.0, making it clear on the component
> site
> that it has been retired. After that the source code repository will get
> archived, meaning it's read only in the future.
>
> The process for retiring a component is described here:
> https://maven.apache.org/developers/retirement-plan-plugins.html
>
> The vote is open for 72 hours.
>
> [ ] +1 Yes, it's about time
> [ ] -1 No, because...
>
> Sylwester
>
Re: [VOTE] Retire Maven Shared IO
Posted by Slawomir Jaranowski <s....@gmail.com>.
+1
my search of usage
https://github.com/search?q=%22%3CartifactId%3Emaven-shared-io%3C%2FartifactId%3E%22+language%3A%22Maven+POM%22++NOT+is%3Aarchived+NOT+is%3Afork&type=code
On Fri, 4 Sept 2026 at 13:23, Sylwester Lachiewicz
<sl...@gmail.com> wrote:
>
> Hi,
>
> Maven Shared IO was last released as 3.0.0 in December 2015. Since then it
> has
> had no user traffic at all: of the 45 issues the repository has ever held,
> 29 are
> the historical JIRA import, 15 come from a code-reading sweep across a dozen
> Maven repositories in July 2026, and one is mine. None is a user reporting
> that
> the component misbehaved for them.
>
> It also has no consumers left. No Apache Maven component imports, the last
> one that did, dropped the
> dependency in 2020 by copying the classes it needed. The two references that
> remain are test-scope only: an integration-test fixture in
> maven-assembly-plugin
> pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> imports
> nothing from it. Open Source Insights reports three direct dependents on
> 3.0.0;
> it gives counts and not names, so I cannot say who they are.
>
> The git history looks more active than that, and I want to be
> straightforward
> about it rather than have someone find it in the first reply: there are 98
> commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are
> Dependabot and most of the rest are fixes for the July sweep. That is a
> component being read, not a component being used.
>
> Finally, the download package has no Maven 4 story. DownloadManager exposes
> Wagon in its published API, and DefaultDownloadManager obtains the Wagon,
> the
> credentials and the proxy from maven-compat's WagonManager, which Maven 4
> does
> not have. Fixing that means breaking the published API of a component nobody
> calls.
>
> I therefore propose that we retire maven-shared-io.
>
> If this vote is successful I will make one final release, which also ships
> the
> fixes that have accumulated since 3.0.0, making it clear on the component
> site
> that it has been retired. After that the source code repository will get
> archived, meaning it's read only in the future.
>
> The process for retiring a component is described here:
> https://maven.apache.org/developers/retirement-plan-plugins.html
>
> The vote is open for 72 hours.
>
> [ ] +1 Yes, it's about time
> [ ] -1 No, because...
>
> Sylwester
--
Sławomir Jaranowski
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Retire Maven Shared IO
Posted by Matthias Bünger <mb...@apache.org>.
+1
Am 04.09.2026 um 13:23 schrieb Sylwester Lachiewicz:
> Hi,
>
> Maven Shared IO was last released as 3.0.0 in December 2015. Since then it
> has
> had no user traffic at all: of the 45 issues the repository has ever held,
> 29 are
> the historical JIRA import, 15 come from a code-reading sweep across a dozen
> Maven repositories in July 2026, and one is mine. None is a user reporting
> that
> the component misbehaved for them.
>
> It also has no consumers left. No Apache Maven component imports, the last
> one that did, dropped the
> dependency in 2020 by copying the classes it needed. The two references that
> remain are test-scope only: an integration-test fixture in
> maven-assembly-plugin
> pinned to 1.1, and a test-classpath entry in a Jackrabbit plugin that
> imports
> nothing from it. Open Source Insights reports three direct dependents on
> 3.0.0;
> it gives counts and not names, so I cannot say who they are.
>
> The git history looks more active than that, and I want to be
> straightforward
> about it rather than have someone find it in the first reply: there are 98
> commits since the 3.0.0 tag, 21 of them this year. Nine of this year's are
> Dependabot and most of the rest are fixes for the July sweep. That is a
> component being read, not a component being used.
>
> Finally, the download package has no Maven 4 story. DownloadManager exposes
> Wagon in its published API, and DefaultDownloadManager obtains the Wagon,
> the
> credentials and the proxy from maven-compat's WagonManager, which Maven 4
> does
> not have. Fixing that means breaking the published API of a component nobody
> calls.
>
> I therefore propose that we retire maven-shared-io.
>
> If this vote is successful I will make one final release, which also ships
> the
> fixes that have accumulated since 3.0.0, making it clear on the component
> site
> that it has been retired. After that the source code repository will get
> archived, meaning it's read only in the future.
>
> The process for retiring a component is described here:
> https://maven.apache.org/developers/retirement-plan-plugins.html
>
> The vote is open for 72 hours.
>
> [ ] +1 Yes, it's about time
> [ ] -1 No, because...
>
> Sylwester
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org