dependency-builds.yml

---
dependencies:
  appdynamics:
    buildpacks:
      php:
        lines:
          - line: latest
    third_party_hosted: true
    source_type: appd_agent
    any_stack: true
    versions_to_keep: 2
  bower:
    buildpacks:
      dotnet-core:
        lines:
          - line: latest
    source_type: npm
    any_stack: true
    versions_to_keep: 2
  bundler:
    buildpacks:
      ruby:
        lines:
          - line: 2.X.X
    source_type: rubygems
    any_stack: true
    versions_to_keep: 2
  CAAPM:
    buildpacks:
      php:
        lines:
          - line: latest
    third_party_hosted: true
    source_type: ca_apm_agent
    any_stack: true
    versions_to_keep: 2
  composer:
    buildpacks:
      php:
        lines:
          - line: latest
    source_type: github_releases
    source_params:
      - 'repo: composer/composer'
      - 'extension: .phar'
    any_stack: true
    versions_to_keep: 2
  dotnet-sdk:
    buildpacks:
      dotnet-core:
        lines:
          - line: 6.0.X
            deprecation_date: 2024-11-08
            link: https://dotnet.microsoft.com/platform/support/policy/dotnet-core
          - line: 8.0.X
            deprecation_date: 2026-11-10
            link: https://dotnet.microsoft.com/platform/support/policy/dotnet-core
        removal_strategy: remove_all
    versions_to_keep: 1
    any_stack: true
  dotnet-runtime:
    buildpacks:
      dotnet-core:
        lines:
          - line: 6.0.X
            deprecation_date: 2024-11-08
            link: https://dotnet.microsoft.com/platform/support/policy/dotnet-core
          - line: 8.0.X
            deprecation_date: 2026-11-10
            link: https://dotnet.microsoft.com/platform/support/policy/dotnet-core
        removal_strategy: remove_all
    versions_to_keep: 1
    any_stack: true
  dotnet-aspnetcore:
    buildpacks:
      dotnet-core:
        lines:
          - line: 6.0.X
            deprecation_date: 2024-11-08
            link: https://dotnet.microsoft.com/platform/support/policy/dotnet-core
          - line: 8.0.X
            deprecation_date: 2026-11-10
            link: https://dotnet.microsoft.com/platform/support/policy/dotnet-core
        removal_strategy: remove_all
    versions_to_keep: 1
    any_stack: true
  go:
    buildpacks:
      go:
        lines:
          #! go version lines lose support the day that the version line 2 minor bumps ahead is released
          #! for example, 1.17.X reaches EOS whenever 1.19 releases. This gap is roughly 12 months.
          - line: 1.21.X
            deprecation_date: ""
            link: https://golang.org/doc/devel/release.html
          - line: 1.22.X
            deprecation_date: ""
            link: https://golang.org/doc/devel/release.html
        removal_strategy: remove_all
    versions_to_keep: 1
  httpd:
    buildpacks:
      php:
        lines:
          - line: latest
    versions_to_keep: 2
    mixins:
      'io.buildpacks.stacks.bionic':
        - libexpat1
  hwc:
    buildpacks:
      hwc:
        lines:
          - line: latest
    source_type: github_releases
    source_params:
      - 'repo: cloudfoundry/hwc'
      - 'fetch_source: true'
    any_stack: true
    versions_to_keep: 2
  jruby:
    buildpacks:
      ruby:
        lines:
          - line: 9.4.X
    source_type: jruby
    versions_to_keep: 2
  libunwind:
    buildpacks:
      dotnet-core:
        lines:
          - line: latest
    source_type: github_releases
    source_params:
      - 'repo: libunwind/libunwind'
      - 'extension: .tar.gz'
    versions_to_keep: 2
  libgdiplus:
    buildpacks:
      dotnet-core:
        lines:
          - line: latest
    source_type: github_tags
    source_params:
      - 'repo: mono/libgdiplus'
      - 'tag_regex: ^[0-9]+\.[0-9]+$'
    versions_to_keep: 2
  miniconda3-py39:
    buildpacks:
      python:
        lines:
          - line: latest
    third_party_hosted: true
    source_type: miniconda
    source_params:
      - 'python_version: 3.9'
    any_stack: true
  nginx:
    buildpacks:
      nginx:
        lines:
          #! nginx deprecation dates are 1 year after the mainline release date
          #! each odd version line (ex. 1.19) is the "mainline"
          #! the even numbered version line that precedes the mainline is the associated stable version line.
          #! See explanation of release cadence: https://www.nginx.com/blog/nginx-1-18-1-19-released/
          - line: 1.26.X
            link: https://nginx.org/
          - line: 1.25.X
            link: https://nginx.org/
    versions_to_keep: 2
  openresty:
    buildpacks:
      nginx:
        lines:
          - line: 1.21.X
          - line: 1.25.X
    versions_to_keep: 2
  nginx-static:
    buildpacks:
      php:
        lines:
          #! nginx deprecation dates are 1 year after the mainline release date
          #! each odd version line (ex. 1.19) is the "mainline"
          #! the even numbered version line that precedes the mainline is the associated stable version line.
          - line: 1.26.X
            link: https://nginx.org/
          - line: 1.25.X
            link: https://nginx.org/
      staticfile:
        lines:
          - line: 1.26.X
            link: https://nginx.org/
          - line: 1.25.X
            link: https://nginx.org/
    source_type: nginx
    versions_to_keep: 2
  node:
    buildpacks:
      nodejs:
        lines:
          - line: 18.X.X
            deprecation_date: 2025-04-30
            link: https://github.com/nodejs/Release
          - line: 20.X.X
            deprecation_date: 2026-04-30
            link: https://github.com/nodejs/Release
          - line: 22.X.X
            deprecation_date: 2027-04-30
            link: https://github.com/nodejs/Release
        removal_strategy: keep_latest_released
      ruby:
        lines:
          - line: node-lts
            deprecation_date: ""
            link: https://github.com/nodejs/Release
      dotnet-core:
        lines:
          - line: node-lts
            deprecation_date: ""
            link: https://github.com/nodejs/Release
    source_type: node
    versions_to_keep: 2
    skip_lines_cflinuxfs3: [ '22.X.X' ]
  php:
    buildpacks:
      php:
        lines:
          - line: 8.1.X
            match: 8.1.\d+
            deprecation_date: 2024-11-25
            link: http://php.net/supported-versions.php
          - line: 8.2.X
            match: 8.2.\d+
            deprecation_date: 2025-12-08
            link: http://php.net/supported-versions.php
          - line: 8.3.X
            match: 8.3.\d+
            deprecation_date: 2026-11-23
            link: http://php.net/supported-versions.php
        removal_strategy: keep_latest_released
    source_type: php
    versions_to_keep: 2
    mixins:
      'io.buildpacks.stacks.bionic':
        - libargon2-0
        - libcurl4
        - libedit2
        - libgd3
        - libmagickwand-6.q16-3
        - libonig4
        - libxml2
        - libyaml-0-2
  pip:
    buildpacks:
      python:
        lines:
          - line: latest
    source_type: pypi
    any_stack: true
    versions_to_keep: 2
  pipenv:
    buildpacks:
      python:
        lines:
          - line: latest
    source_type: pypi
    versions_to_keep: 2
  python:
    buildpacks:
      python:
        lines: #! python 3 minor version EOLs are 5 years after their first final release
          #! https://devguide.python.org/#status-of-python-branches
          - line: 3.8.X
            deprecation_date: 2024-10-14
            link: https://www.python.org/dev/peps/pep-0569/
          - line: 3.9.X
            deprecation_date: 2025-10-05
            link: https://www.python.org/dev/peps/pep-0596/
          - line: 3.10.X
            deprecation_date: 2026-10-04
            link: https://www.python.org/dev/peps/pep-0619/
          - line: 3.11.X
            deprecation_date: 2027-10-24
            link: https://www.python.org/dev/peps/pep-0664/
          - line: 3.12.X
            deprecation_date: 2028-10-02
            link: https://www.python.org/dev/peps/pep-0693/
      nodejs:
        lines:
          - line: 3.11.X
            deprecation_date: 2027-10-24
            link: https://www.python.org/dev/peps/pep-0664/
        removal_strategy: remove_all
    versions_to_keep: 1
  r:
    buildpacks:
      r:
        lines: #! final release for each minor version is every spring ( just before next minor version release )
          - line: 3.6.X
          - line: 4.2.X
          - line: 4.3.X
          - line: 4.4.X
        removal_strategy: keep_latest_released
    monitored_deps:
      - rserve
      - forecast
      - shiny
      - plumber
    versions_to_keep: 1
    #! R doesn't publish EOL dates but 3.6 hasn’t made a release in 3 years and community feedback suggests 3.x contains known security issues
    skip_lines_cflinuxfs4: [ '3.6.X' ]
  ruby:
    buildpacks:
      ruby:
        lines:
          - line: 3.0.X
            deprecation_date: 2024-03-31
            link: https://www.ruby-lang.org/en/news/2020/12/25/ruby-3-0-0-released/
          - line: 3.1.X
            deprecation_date: 2025-03-31
            link: https://www.ruby-lang.org/en/news/2021/12/25/ruby-3-1-0-released/
          - line: 3.2.X
            deprecation_date: 2026-03-31
            link: https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/
          - line: 3.3.X
            deprecation_date: 2027-03-31
            link: https://www.ruby-lang.org/en/news/2023/12/25/ruby-3-3-0-released/
        removal_strategy: keep_latest_released
    versions_to_keep: 2
    #! Older ruby versions aren't compatible with openssl 3 of jammy
    #! There may be workarounds but decided not to support these versions.
    skip_lines_cflinuxfs4: [ '2.7.X', '3.0.X' ]
  rubygems:
    buildpacks:
      ruby:
        lines:
          - line: latest
    source_type: rubygems_cli
    any_stack: true
    versions_to_keep: 2
  setuptools:
    buildpacks:
      python:
        lines:
          - line: latest
    source_type: pypi
    any_stack: true
    versions_to_keep: 2
  yarn:
    buildpacks:
      nodejs:
        lines:
          - line: latest
      ruby:
        lines:
          - line: latest
    source_type: github_releases
    source_params:
      - 'repo: yarnpkg/yarn'
      - 'extension: .tar.gz'
    any_stack: true
    versions_to_keep: 2
cflinuxfs4_build_dependencies: [ 'libunwind', 'libgdiplus', 'node', 'pipenv', 'python', 'go', 'godep', 'glide', 'dep', 'ruby', 'jruby', 'nginx', 'nginx-static', 'openresty', 'r' , 'httpd', 'php' ]
cflinuxfs4_dependencies: [ 'bower', 'libunwind', 'libgdiplus', 'node', 'dotnet-sdk', 'dotnet-runtime', 'dotnet-aspnetcore', 'pipenv', 'python', 'yarn', 'pip', 'setuptools', 'miniconda3-py39', 'go', 'godep', 'glide', 'dep', 'ruby', 'jruby', 'bundler', 'rubygems', 'nginx', 'nginx-static', 'openresty', 'r', 'appdynamics', 'composer', 'httpd', 'php' ]
cflinuxfs4_buildpacks: [ 'dotnet-core' , 'nodejs', 'python', 'go', 'ruby', 'nginx', 'r', 'php', 'staticfile' ]
build_stacks: [ 'cflinuxfs4' , 'cflinuxfs3' ]
windows_stacks: [ 'windows2016', 'windows' ]

#! only check deprecation dates for dotnet-runtime as they are redundant for sdk and aspnetcore
skip_deprecation_check:
  - bundler  #! doesn't publish EOL schedule
  - dotnet-sdk  #! same as dotnet-runtime
  - dotnet-aspnetcore  #! same as dotnet-runtime
  - jruby  #! tied to ruby, ruby doesn't publish EOL schedule
  - nginx  #! doesn't publish EOL schedule
  - nginx-static  #! same as nginx
  - openresty  #! depends on nginx and lua deprecation
  - php  #! complicated
  - ruby  #! doesn't publish EOL schedule
  - r  #! doesn't publish EOL schedule