Skip to content

v0.3.17 — Maven registry signals: relocations, verified unlisted, ages

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Aug 19:46
v0.3.17
2be2dd8

Maven joins the registry lineup

Twelfth registry: gradle.lockfile diffs (and Maven packages in SBOMs) now
get signals from the Maven repositories themselves — Central, falling back
to Google's Maven repository, where the androidx world lives.

  • Relocation stubs land in the deprecation lane. A bump onto a POM
    whose <distributionManagement><relocation> points at new coordinates
    is flagged with those coordinates and the author's message:

    ↑ mysql:mysql-connector-java 8.0.29 → 8.0.33  patch  (3y old)
    ● deprecated upstream: relocated to com.mysql:mysql-connector-j — MySQL Connector/J artifacts moved to reverse-DNS compliant Maven 2+ coordinates.

    deps.dev has no relocation concept, so these were invisible before.

  • Registry-verified unlisted detection. The ▲ not in registry index
    flag is settled by the repository's own per-version POM: a version
    Central or Google serves loses the flag (deps.dev can lag by days), a
    version both 404 on keeps it.

  • Release-age backfill from the POM's Last-Modified upload time for
    versions deps.dev hasn't indexed yet, so the ⏱ cooldown flag works on
    freshly cut Java releases too.

One anonymous CDN GET per introduced group:artifact version — the same
files every mvn/gradle build resolves against — deduplicated across
lockfiles, 8-way concurrent, with the winning host remembered per package.
Neither host sends CORS headers, so the browser playground keeps the
deps.dev-only layer for Maven (like RubyGems).

Full Changelog: https://github.com/matteo-sung/lockvet/blob/main/CHANGELOG.md

Assets 9
Loading