-
Notifications
You must be signed in to change notification settings - Fork 17.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
dep: officially deprecate the "dep" experiment #38158
Comments
Thanks for filing this proposal. We have been leaving Dep status alone and letting the users decide when they move. I saw @ALTree's PR and was waiting to see if the Dep maintainers had any comments. Using the proposal process seems like a good way to decide what to do with that PR. Here are some recent numbers I gathered, not specifically for this issue. I built a list of ~all the public GitHub projects with ≥ 1000 stars and also downloaded some basic metadata about the default branch of the repo. This lets us understand a little about the current state of popular projects, including popular Go projects. Out of 23,531 projects, 1,033 have a .go file in the root directory. Of those 640/1,033 (62%) also have a go.mod file. There are another 237 which have a go.mod but no .go sources, presumably because their Go sources are in subdirectories. If we include those, we have 877/1,270 (69%). For comparison, 73/1,033 (7.1%) have dep's Gopkg.toml, and 19/1,033 (2%) have godep's Godeps directory. There is a small amount of overlap: 11 have both go.mod and Gopkg.toml, so Dep-only is 62/1,033 (6.0%). Limiting to projects for which the HEAD commit happened in the past six months, 588/742 (80%) or 812/966 (84%) use modules. Dep is 40/742 (5.4%). Dep-only is 32/742 (4.3%). Limiting to the past three months, 515/629 (82%) or 727/841 (86%) use modules. Dep is 37/629 (5.9%). Dep-only is 29/629 (4.6%); full list below in the toggle. So it looks like there are still a few active Dep users, but most of the Go user base has migrated at this point. Like I said, we'll put this through the proposal process and get this into the minutes for this week. Thanks. The 29 dep-only GitHub projects with ≥ 1000 stars and commits in 2020
|
@rsc could I point out, that, from personal experience, dependency management is generally more critical for (private) applications, than for (open source) libraries. I suspect, that by counting raw numbers of users it will make it look like 100 small and popular libraries, that "don't care what dependency management system they use", overweight 1 large application, that uses those libraries. Clarifying the status of dep is very important for companies' so they can move towards to modules. Right now, because dep is part of golang's GitHub organisation and it isn't officially deprecated, it isn't clear for management and development if they must invest in changing what used to work or they can wait until dep will catch up. |
Does anyone object to accepting this proposal? |
Based on the (lack of) discussion above, this seems like a likely accept. I will also comment on golang/dep#2233. |
I see golang/dep#2233 got merged, which is great. I'm wondering if we should add some stronger language though, stating that the project is no longer maintained and everyone is encouraged to migrate to modules? |
The top of the README also asks for funding, which is a bit weird for a deprecated experiment. I think we should archive the github repository in the short term, to clarify that it's there for historical reasons, and won't see more development in the future as part of the Go project. |
There is also https://golang.github.io/dep/ which doesn't mention modules at all. |
Good point, @flibustenet. It's the second result when one googles "go dep", so I think it should be fixed up too. The source seems to be under the same repo, at https://github.com/golang/dep/tree/master/website. |
Alright, so follow-ups so far:
|
Because this is a significant issue, I'm going to leave this for an extra week of "likely accept" before moving it to accepted. I note that golang/dep#2233 has been merged, so what's being proposed here has become a smaller delta. |
No change in consensus here, so accepting. |
I'm still confused - when and where were you given access or custody of the project? I'm sorry that I've made you feel that way, but again, I was not aware and haven't seen any evience to make me think that I could have done better.
You were in multiple github threads where the plan to archive the repository was made clear, such as in the link I shared above with Andy's comment. As far as I can tell, you were made aware of the plan in at least that one place. If there is a newer thread that I've missed where it's agreed that the dep repo will remain active and in your custody, could you share a link?
You can filter by |
Let's not pretend that Excluding my PR to update the README, the latest commit is from August 2019, and the latest release is from July 2019. And unless I failed to properly search the issue tracker, the last time you commented on an issue or a PR was in November 2019. Nobody realized you were maintaining it because there hasn't been basically any activity on the repository in the last year. |
I'm going ahead with the paragraph from #38158 (comment) on both the README and the github.io site, just to not leave the project in a half-deprecated state where the README still asks for funding. It got thumbs up from two people who are Gerrit approvers, so I reckon that's enough in terms of code review. I won't archive the repo just yet, pending more discussion, but as far as I can tell that is still the short-term plan. |
You can get that easily with github search feature: https://github.com/golang/dep/issues?q=is%3Aissue+is%3Aclosed+closed%3A%3E2020-08-01+ and scrape them using github's API, there's even a go package to do it; make sure to get v31.0.0 I've heard it's the finest one. |
Thanks @andybons! I've added a clear note to both the README and the first page of the github.io docs page; see golang/dep#2253. Out of respect for those being away from the computer on the weekend, and to give an extra few days for others to comment, I'll wait until Tuesday morning to archive the repository. |
What about the possibility of a transfer, to avoid having to write some automation to figure out how to life-and-shift issues? |
That was proposed and rejected in #29639. |
It's already Tuesday evening, so I've archived the repository. As far as I can tell, all the items in this proposal have now been completed, so I'm closing it. |
Thanks @mvdan. Sorry we didn't close the circle on this sooner. |
'dep' has been deprecated since 2020. See golang/go#38158.
'dep' has been deprecated since 2020. See golang/go#38158.
'dep' has been deprecated since 2020. See golang/go#38158.
This is a request to officially deprecate the "dep" package manager for Go, and would resolve #35894.
Rationale
The Go ecosystem has moved towards Go Modules, introduced in Go 1.11 and considered stable and production ready since 1.14. Many projects have started migrating to Go Modules, or already completed that migration since Go 1.12 was released.
Despite the fact that the Go project and Go ecosystem have largely embraced modules, dep remains in use by people. Unfortunately most if not all dep maintainers have moved on from the project. The net result of this is though people do still submit issues to the issue tracker and the occasional PR, no help is offered or review is received. This is not a good experience for any member of the Go community.
Changes
I would like to propose the following:
The text was updated successfully, but these errors were encountered: