Policy to replace registered packages by major version updates

heliosdrm
Sun, 19 Oct 2025 21:36:34 +0000
Package Management

The recent discussion on Should General have a guideline or rule preventing registration of vibe-coded packages? raised again the problem of the General registry being polluted with “trash packages”, which is a problem because packages cannot be de-registered, and among other issues - at least in the current state of affairs - package names are bound to their UUIDs, so the names of registered packages become unusable by others.

However there are antecedents of packages not meant to be maintained any longer, and others taking over their names. This happened when LightGraphs.jl was rebranded as Graphs.jl (and the unmaintained Graphs.jl as it was then was in turn rebranded as OldGraphs.jl). More recently, the publication of JSON.jl v1 looks very much as a replacement by the concept that was implemented in JSON3.jl, although it is not as complete as the Graphs/LightGraphs case. This has been done without breaking things in the registry, by publishing a major version of the package with the “nice” name.

Now, I’m aware that these cases have happened because former maintainers of Graphs.jl and JSON.jl were involved in the “replacements”; otherwise things wouldn’t be as easy. But would it be possible to define a policy or a procedure to give way to a similar kind of name replacement by version updates of packages in some kinds of special situations?

As I understand it, the major stumbling block is that for this to work the UUID should be taken over too, so if this is done with the new package living in a different repository, it wouldn’t really be a “Unique-UID”. Therefore, those “kinds of special situations” would have to be restricted to cases in which there is no doubt that the replaced package is really abandoned, and the original author won’t reclaim that UUID ever again. I’m thinking, for instance, in cases of “solo” packages that were early registered in good faith, but ended in nothing, and their authors agree to somehow declare that they give up its development (and give away the name and the UUID).

2 posts - 2 participants