search

lsh123 / xmlsec

XML Security Library
Other
127 stars 97 forks source link

Could Semver be applied in xmlsec? #769

Closed deronnax closed 3 months ago

deronnax commented 3 months ago

Hello. I would like to report that xmlsec removed support for some stuff in xmlsec 1.3.3, which significantly broke python-xmlsec. Semver mandates that breaking changes be a major version upgrade and no breaking changes happen in minor/patch version bump. Could Semver be applied for future changes? Thank you very much?

lsh123 commented 3 months ago

There was a version bump 1.2.x -> 1.3.x. Note that the removed stuff was marked as "deprecated" for 5+ years. The python-xmlsec ignored the warnings all this time.

deronnax commented 3 months ago

OK but though, the removal should have been done in the 1.2.x -> 1.3.x bump. Everybody assume a patch update won't do major breakage. It's painful even for linux distribution maintainer would did nothing wrong.

lsh123 commented 3 months ago

the removal should have been done in the 1.2.x -> 1.3.x bump

this is exactly what happened

deronnax commented 3 months ago

Sorry to insist, I don't mean to be rude or unpleasant, but, unless I am mistaking, commit 114f580409e076bbe7b352eb74008d818c6e3e93, which has been made between 1.3.2 and 1.3.3, removes functions, among other things xmlSecCryptoAppKeyLoad, which broke python-xmlsec.

lsh123 commented 3 months ago

Ah sorry, I thought you are talking about soap stuff. I'll keep this in mind, but in general I feel that several years of marked as "deprecated" should be good enough warning.

deronnax commented 3 months ago

Sure, but both are valid: several years of marked as "deprecated" is a good reason to remove stuff, but it should still be done with at least a minor (major should be the way to go but some people don't like this because it doesn't feel enough of a change but that's OK if you are on the "minor bump" team) :) Thank you for your time.