The state of DefinitelyTyped packages on NuGet.org

[joelverhagen]

I'm engineering manager for NuGet.org. I'd like to open a dialog about the DefinitelyTyped packages on NuGet.org. Judging by the package IDs ending in ".DefinitelyTyped", these are almost entirely owned by the DefinitelyTyped user: https://www.nuget.org/profiles/DefinitelyTyped

Based on the update on the front page of this repo (https://github.com/DefinitelyTyped/NugetAutomation#-update-), it seems like these packages are essentially deprecated.

This project is now officially pretty much over... Since the conversion to type defs 2.0 where all types are in npm nuget packages are no longer being published or supported...

I'd like to understand if there is something we (as the NuGet.org team) can do to help you mark the packages as no longer supported.

There are currently 2,283 packages owned by this user, with a cumulative 68,816 versions, and 120 million downloads. The top package was downloaded over 90,000 times in the past 6 weeks. At face value, the packages appear supported from a NuGet.org perspective (aside from the old last-updated date) and are being actively used today.

Our goal is to support you in expressing the intent you have on the NuGet packages using package deprecation and/or package unlisting. These are features that will clarify to package consumers about the state of the packages to reduce future adoption. The NuGet.org team generally does not make metadata updates to packages without the consent of the package owners but we'd like to make ourselves available bring these packages and your account into a state that is (primarily) agreeable to you and (secondarily) clearest for general package consumers.

One proposal would be to deprecate and unlist all DefinitelyType packages. We could put a deprecation message on each package that says something like "NuGet-based DefinitelyType packages are no longer supported. Please see the README on the DefinitelyTyped project (https://github.com/DefinitelyTyped/DefinitelyTyped) for more information.".

Deprecation looks like this (example):

Package deprecation was feature that was added after the DefinitelyTyped packages were pushed to NuGet.org. Generally, we do not delete packages because of the outsized impact it may have on existing package consumers. I'd like to emphasize that no action is strictly required, but I would like to take an opportunity to improve NuGet.org package metadata if we're all in agreement.

If you have any questions, feel free to post here or reach out to [email protected] and we can help you out.

Thanks to @DanielRosenwasser and @RyanCavanaugh for helping me connect the dots with where these packages came from.

[RyanCavanaugh]

@staxmanade I believe you're an owner on these packages?

[staxmanade]

Hey @joelverhagen - Yea this is 💀 👎 ⛔ 🚫 🙅

Could you use this message my approval to go ahead and deprecate with your proposed deprecation message?

Thanks you

[joelverhagen]

Sorry for the delay @staxmanade, I propose the following:

1. Deprecate the packages as "Legacy" with the message:

   This project is now officially over. Since the conversion to type defs 2.0, all types are in npm. The NuGet packages are no longer being published or supported.

2. Unlist the packages as well. This will hide them from search to reduce future adoption, but existing users will still be able to download them.

To perform these steps, we will temporarily add NuGetAdmin as a co-owner of the package so that we can perform a scripted deprecation flow.

Does this all sound okay?

[staxmanade]

Works for me - Thanks for doing this.

[joelverhagen]

Per this discussion, I have made myself co-owner of the packages and will begin slowly deprecating them as described above.