search

hexpm / hex

Package manager for the Erlang ecosystem.
https://hex.pm
961 stars 184 forks source link

Retire a package completely? #1003

Closed halostatue closed 11 months ago

halostatue commented 11 months ago

I think there should be a way to "retire" a package completely so that people can be warned away from using it — either because it is no longer maintained, it's not really compatible with recent versions of Elixir, or because it is an extension package that is no longer required because the core implements what it did in its entirety.

Ideally, when retiring a full package, the maintainer would be able to include a reference to a "use instead" recommendation.

I don't need this right now, but I have recently found a package that I have used in the past is no longer necessary, and have recommended that the GitHub repo be archived; that does not stop people from possibly using it by finding it on hex.pm.

supersimple commented 11 months ago

Hello. Can you please explain more what the feature is? We currently support retiring a package, which is visible on the hex.pm site as well as in the CLI: image image

what additions would you like to see? Thanks

halostatue commented 11 months ago

The current command is mix hex.retire PACKAGE VERSION REASON. I’d be looking at something that retroactively retires all the versions, if possible, using the same reason.

So maybe mix hex.retire_all PACKAGE REASON or something like that.

supersimple commented 11 months ago

Thanks. We had this discussion a few years ago: https://github.com/hexpm/hex/issues/564 IIRC @wojtekmach offered his preferred solution. It hasn't really come up often, so I am not sure opinions will have changed much on the value of adding it. (BTW I was the one that originally suggested the feature.)