mvnreg

Documentation

Overview

Package mvnreg asks the Maven repositories themselves — Maven Central and Google's Maven repository — about the artifacts a diff introduces:

• Relocations: a bump onto a relocation stub (a POM whose <distributionManagement><relocation> points at new coordinates — mysql:mysql-connector-java → com.mysql:mysql-connector-j) lands in the deprecation lane with the new coordinates and the author's message. deps.dev has no relocation concept, so these were invisible before.
• The per-version POM probe re-verifies Unlisted flags set by the deps.dev layer, which can lag the repositories by days: a version Central serves is not unlisted. Central is immutable — artifacts are only removed by Sonatype intervention — so a version it lacks while siblings exist keeps the flag.
• Release ages: the POM's Last-Modified header is the upload time, backfilling ages (and the ⏱ cooldown flag) for versions deps.dev has not indexed yet.

One anonymous GET per introduced group:artifact version — the same CDN-backed files every `mvn` and `gradle` build resolves against; no rate limits apply. Artifacts that 404 on Central are retried on Google's repository (androidx.* and friends live there, and deps.dev indexes both); the winning host is remembered per package. Neither host sends CORS headers, so the browser (wasm) build skips this check and keeps the deps.dev-only layer.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) error
• func DecodeXML(data []byte, v any) error

Variables

var (
	CentralURL      = "https://repo1.maven.org/maven2"
	GoogleURL       = "https://dl.google.com/android/maven2"
	PluginPortalURL = "https://plugins.gradle.org/m2"
)

CentralURL and GoogleURL are the repository bases; vars so tests can fake them.

var Now = time.Now

Now is a var so tests can pin the clock.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) error

Annotate fills Maven repository signals on the diffs; see the package comment for what it flags. Call it AFTER depsdev.Annotate (it re-verifies deps.dev-based Unlisted flags and backfills what deps.dev lacks). freshDays mirrors the -fresh-days flag for the ⏱ backfill. Best-effort: network errors return an error but leave diffs usable.

func DecodeXML

func DecodeXML(data []byte, v any) error

DecodeXML unmarshals repository XML tolerating the ASCII-family encoding declarations Maven repositories actually serve (the Gradle Plugin Portal declares US-ASCII, which encoding/xml refuses without a CharsetReader). ASCII is a UTF-8 subset, so passing the bytes through is exact.