Whoop, this report is a bit late, but I still want to give a summary of what the Stewardship SIG has been up to in August. TL;DR: We reduced the number of outdated packages from about 55% to about 45% and introduced some changes to limit the number of packages that we’re going to have to maintain in the future.

We started by removing some unused functionality from a few packages (especially dropping the dependency on the Spring framework, which was removed from fedora at the beginning of August due to it failing to build from source since fedora 29.

package version release changes
google-guice 4.1 16.fc31 disable support for spring and JPA
snakeyaml 1.17 9.fc31 drop spring dependency
xbean 4.9 5.fc31 drop spring and groovy support

We also started working on getting some packages updated to the latest versions. Most of our packages haven’t been touched since 2017, so there’s a lot of outstanding new releases pending, and this is only a small start.

package version release changes
ant 1.10.6 1.fc31 1.10.5 → 1.10.6
jna 5.4.0 1.fc31 4.5.1 → 5.4.0
apache-logging-parent 2 1.fc31 1 → 2
apache-mime4j 0.8.3 1.fc31 0.8.1 → 0.8.3
apache-rat 0.13 1.fc31 0.12 → 0.13
bean-validation-api 2.0.1 1.fc31 1.1.0 → 2.0.1
woodstox-core 5.2.1 1.fc31 5.0.3 → 5.2.1
plexus-io 3.1.1 1.fc31 3.0.0 → 3.1.1
google-guice 4.2.2 1.fc31 4.1 → 4.2.2

Meeting in person at flock in Budapest, we also finally decided that we couldn’t continue maintaining Gradle and the build system support for it any longer due to numerous issues (including Gradle failing to build since fedora 30, the package being massively outdated, and newer versions requiring even more yet unpackaged dependencies). So we dropped support for builind packages with Gradle from both xmvn and javapackages-tools for fedora 31 and later.

Maintainers of packages that get built with Gradle will have to adapt (it’s usually possible to convert builds to use Maven instead, which is already the way it works for some existing fedora packages).

package version release changes
xmvn 3.0.0 25.fc31 disabled support for gradle
javapackages-tools 5.3.0 6.fc31 disabled support for gradle

Then we pushed some more changes to packages to remove additional dependencies, so we don’t have to keep adopting more and more packages to keep things working. We made sure to only remove functionality that wasn’t in use in other fedora packages.

package version release changes
apache-commons-compress 1.18 6.fc32, 6.fc31 drop powermock dependency
bsf 2.4.0 34.fc32, 34.fc31 removed rhino dependency
apache-ivy 2.4.0 18.fc32, 18.fc31 disable ssh, bouncycastle, and vfs support

Then started a second round of version updates, which brought the percentage of outdated packages to below 50% (which is progress).

package version release changes
jboss-annotations-1.2-api 1.0.2 1.fc32, 1.fc31 1.0.0 → 1.0.2
jboss-connector-1.7-api 1.0.1 1.fc32, 1.fc31 1.0.0 → 1.0.1
jboss-el-2.2-api 1.0.5 1.fc32, 1.fc31 1.0.2 → 1.0.5
plexus-archiver 4.1.0 1.fc32, 1.fc31 3.6.0 → 4.1.0
maven-archiver 3.4.0 1.fc32, 1.fc31 3.2.0 → 3.4.0
maven-assembly-plugin 3.1.1 1.fc32, 1.fc31 3.1.0 → 3.1.1

We also updated flex to the latest version and pushed a patch to adapt qdox to these changes.

package version release changes
jflex 1.7.0 1.fc32, 1.fc31 1.6.1 → 1.7.0
qdox 2.0 6.M9.fc32, 6.M9.fc31 port to jflex 1.7.0

A third round of easy version updates followed, where we still pushed our changes to both rawhide and the pre-beta fedora 31 branch.

package version release changes
maven-dependency-analyzer 1.11.1 1.fc32, 1.fc31 1.10 → 1.11.1
maven-shade-plugin 3.2.1 1.fc32, 1.fc31 3.1.1 → 3.2.1
modello 1.10.0 1.fc32, 1.fc31 1.9.1 → 1.10.0
plexus-containers 2.0.0 1.fc32, 1.fc31 1.7.1 → 2.0.0
plexus-compiler 2.8.5 1.fc32, 1.fc31 2.8.2 → 2.8.5
plexus-components-pom 4.0 1.fc32, 1.fc31 1.3.1 → 4.0
xbean 4.14 1.fc32, 1.fc31 4.9 → 4.14
felix-utils 1.11.2 1.fc32, 1.fc31 1.10.4 → 1.11.2

In preparation for other updates we worked to update xmlunit to the latest major version, and pushed a patch for xmvn to adapt to this new version.

package version release changes
xmlunit 2.6.3 1.fc32, 1.fc31 1.6 → 2.6.3
xmvn 3.0.0 26.fc32, 26.fc31 port to xmlunit 2

We also updated snakeyaml to the latest version, which contained some minor changes in API. I pushed a patch for jruby to adapt to these changes. No other packages were affected.

package version release changes
snakeyaml 1.25 1.fc32, 1.fc31 1.17 → 1.25
jruby 1.7.22 10.fc32, 10.fc31 port to snakeyaml 1.20+

Last, we disabled some more unused features in two packages to make sure we don’t depend on packages that are going to be removed due to the 6-week-orphan retirement process.

package version release changes
httpcomponents-client 4.5.7 3.fc32, 3.fc31 disable memcached and ehcache support
maven-wagon 3.3.3 3.fc32, 3.fc31 disable SSH support