Hi all, so our team landed all 23 PRs needed to adapt the identified impacted plugins in the ecosystem. The thing is: in those PRs, many plugins are just abandoned, some since up to 9 years.
The detailed status table is available on the PR itself: https://github.com/jenkinsci/jenkins/pull/5320 I have just done another round of status assessment on the whole list. In summary the status is the following: - subversion, maven-info and clover: Done. They got a release already. (thanks Tim, Marek & Olivier!) - cvs fix is merged, waiting for a release. (this is really the only must-have to me, cvs still being reported as installed 40k times...) These 4 above are the most installed plugins impacted by the removal of commons-digester. The least popular of these 4 is clover with 3521 installs. In short, here are the plugins that I do not think we will get a merge, even less a release for, because of lack of maintainership: - emma 3216 - cloverphp 2801 - vs-code-metrics 1435 - BlameSubversion 878 - javatest-report 440 - clearcase-ucm 266 - vss 168 - synergy 96 - config-rotator 62 - harvest 49 - cmvc 18 So the big question is: what do we do? I personally think we should NOT make these PRs land if no maintainer steps up. In other words, once we merge and release the Core PR, these plugins will likely just fail loading on newer Jenkins releases. I'm proposing the following action plan to move forward: - This week: blog entry on Jenkins.io summarizing this and heads-up to users for these plugins - Some time next week: merge https://github.com/jenkinsci/jenkins/pull/5320 - this way we still give some more time to plugins to be released (like cvs). - 2021-05-17: the first weekly without commons-digester:2.1 is released. - anything else? (I'm also thinking we might want to consider using an AdminMonitor, like the PluginDeprecationMonitor? <https://github.com/jenkinsci/jenkins/blob/6384f1965f290494332cc4853ddbadadd728e810/core/src/main/java/hudson/PluginManager.java#L2389>, not sure anymore what we'd do nowadays for such case?) WDYT? Le lun. 3 mai 2021 à 10:33, Oleg Nenashev <o.v.nenas...@gmail.com> a écrit : > Hi Baptiste, > > Thanks a lot for this work! Commons Digester is definitely a legacy that > we should rather remove from Jenkins. It should be perfectly fine as long > as we provide an upgrade path in plugins, timely deprecate and announce the > removal. We're doing pretty much the same process for Ruby and Python > plugin runtimes, and the process can be partially inherited from that or, > if you prefer a longer rollout, from JEP-200. > > If we have many such removals, slated for a single release, maybe we > should consider doing Jenkins 3. I have a proposal in works towards the > contributor summit in June, but I am not ready to share it yet. > > Best regards, > Oleg Nenashev > > P.S: +100 for referencing Shifting Gears! > > > On Sunday, May 2, 2021 at 10:52:26 PM UTC+2 Baptiste Mathus wrote: > >> Hi all, >> >> I was considering just posting a link in the plugins EOL thread, but >> thought I'd fork to keep the other thread focused. (and not end up stealing >> it). >> >> We are currently working on *removing* commons-digester:2.1 >> <https://search.maven.org/artifact/commons-digester/commons-digester/2.1/jar> >> from Jenkins Core. >> >> *https://github.com/jenkinsci/jenkins/pull/5320 >> <https://github.com/jenkinsci/jenkins/pull/5320>* >> >> After considering an upgrade, we chose the removal path. In particular >> because the very reason why it is outdated (2010...) and hard to update is >> that it leaked since many years in the whole Jenkins ecosystem. So we are >> doing what is deemed right by many, rather than just upgrading so we're in >> the same situation in 5+ years from now. >> As Jesse put it >> <https://github.com/jenkinsci/jenkins/pull/5320#issuecomment-790114286>: >> >> *I would rather suggest deprecating Digester2 and maybe detaching it to a >> split plugin, unless we can kill all plugin references.* >> >> >> After analyzing the impact, we are now pursuing the "unless" part :-). >> We're fixing the ecosystem instead. 20 plugin PRs, counting. >> >> So this email has a few purposes: >> >> 1. Raise awareness on these 20+ PRs we opened to fix the ecosystem. >> If you are a Jenkins plugin maintainer, please look at the list in the >> table in the description of the Core PR above >> <https://github.com/jenkinsci/jenkins/pull/5320>. >> 2. Add an interesting data point to the plugin EOL policy discussion: >> you'll see that in these PRs, a lot are on *very* old plugins, which many >> look unmaintained. If the policy was in place already, this may have >> simplified our work subtantially. And I do think this is vital for us that >> we can spend our scarce time rather on making Jenkins shine, than on >> making >> sure plugins released last 5 to 9 years ago, with less than 200 installs >> worldwide, still work... >> 3. *Custom plugins: if you have developed a custom in-house plugin in >> your company, please make sure to NOT use commons-digester anymore from >> Jenkins Core.* >> >> >> Given Guava update/removal is another (_much_ bigger) subject in the >> radar, I thought raising this would be a good thing for a global awareness. >> Again, I think being able to tackle such cleanup tasks is vital to our >> continued success. >> Being stuck to use some 10+ years old dependencies in our beloved tool >> cannot be a good thing. >> While we have always valued compatibility deeply >> <https://www.jenkins.io/project/governance/#compatibility-matters>, we >> also accepted that potentially breaking some things >> <https://www.jenkins.io/blog/2018/08/31/shifting-gears/> is critical for >> us to be able to focus more of our time on the right things. >> >> -- Baptiste >> > -- > You received this message because you are subscribed to the Google Groups > "Jenkins Developers" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to jenkinsci-dev+unsubscr...@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/jenkinsci-dev/ea8584a7-12ce-42a4-b89c-6b95b91461f6n%40googlegroups.com > <https://groups.google.com/d/msgid/jenkinsci-dev/ea8584a7-12ce-42a4-b89c-6b95b91461f6n%40googlegroups.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "Jenkins Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-dev+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/CANWgJS4Bhd%3DxSqyZiLw6vXvM%2Bugx578N6ZgOeMgkQS51aPT8iA%40mail.gmail.com.
