Version policy : third-party upgrades in a minor release ?

[Cantor, Scott]

On 10/22/15, 6:53 PM, "dev on behalf of Tom Zeller" <dev-bounces at shibboleth.net on behalf of tzeller at dragonacea.biz> wrote:

>Not urgent, but I do have a question about the Java Product Version Policy in regards to upgrading 3rd party dependencies in a minor release of the IdP. The policy states that 3rd party library upgrades “must follow the Java API compatibility rules”. My question is : how do we assess that ? Especially since our definition is broad.

As best we can, basically. By observing what other projects commit to, if anything, and generally discouraging use of third party APIs in extensions.

>Lacking a tool to check API compliance, it seems we would then in general not upgrade dependencies in a non-major release unless there are security issues.

Many patch releases include fix lists that provide some indication that they're just internal fixes. Doing minor upgrades of most dependencies would be less common unless we had a decent handle on what they were doing.

>I had been thinking we would bump non-major dependency (and Maven plugin) versions for the minor release of the IdP, but the policy seems to constrain that. Which is fine, it just means that we need a major version bump to freely upgrade dependencies which don’t have security updates.

The policy doesn't constrain it, other projects just aren't well managed. That lack of care is what constrains it.

-- Scott