Text files?
If people get value from it, editing a simple text file once or twice a year wouldn't be difficult.
If people get value from it, editing a simple text file once or twice a year wouldn't be difficult.
Option 1: Adding feature to npm/composer/gem/pip ad infinitum
Option 2: add per-language parser support to the alerting tool instead.
Option 2 doesn't necessitate a new (information-duplicating, still potentially error prone) standard, and can likely leverage available, tested libraries ;-)
* any non Javascript / ruby / go languages don't have standard packages, package names, etc.
* any non Javascript / ruby / go languages may be using one of many build systems. It's just too hard to troll through random build systems to see what dependencies are used
* therefore, a simple text file is what will work, and is what will be trivial for everyone to use
* if you find it too hard to update one line in a text file when you add (for example) a new dependency on libldap... you shouldn't be programming
Would have thought Maven popularized standard package names and build dependency (POM) files.
A text file that just declares that "this project uses lib 2.1". It isn't a part of the build system in any way.
That would be awesome.