External library management

[michelou]

The contents of the Scala 3 software distribution has changed quite a bit compared to Scala 2.

Consider the page DEPS.md in my GitHub repository dotty-examples as an initial motivation for starting this discussion.

Here are a few concrete questions/discussion topics (including but not limited) :

• What is the work schedule for upgrading versions of external libraries, e.g. flexmark-* 0.62.2 (latest) versus flexmark-* 0.42.12 (current) ?
• Why do dependencies on jackson librairies use two different versions, i.e. jackson-annotations 2.2.3 versus jackson core 2.9.8 ?
• Would a dedicated Markdown page help to document dependency changes for Scala developers ?
• What are the management rules of software companies working with Scala ? Two examples (for illustration) :
  • Lightbend : Scala 2.13 Updates (June 2019), Library build dependencies.
  • LinkedIn : External Library Management (August 2017).

[SethTisue]

We recently enabled Scala Steward in the Scala 2 repo, hoping that will help things from drifting out of date. (Though usually the dependencies are tooling/testing things, rather than end-user-facing.)

[michelou]

@SethTisue Adding Scala Steward is for sure a step in the right direction even if the introduction of such a control tool appears late in the development process IMO.

I agree that the dependencies are tooling/testing things, rather than end-user-facing but I would nevertheless add the following two points:

• Nothing prevents a Scala developer (end-user) to make use of a library bundled with the Scala software distribution.
• I know of several companies and administrations where security audits take the whole development/deployment tool chain into account when validating software products.