API/Metadata to find the release date of a Maven artifact?

Question

Given the Maven coordinates (group, artifact, version) of an arbitrary released artifact that you're capable of resolving, (an artifact which may or may not have been sent to Maven Central - could have been released to another artifact repository, public or private), what is the best way to determine the release date of that artifact?

Use case

Scala Steward is a bot that helps keep project library dependencies up to date, automatically opening PRs to update dependencies. However, some dependencies - like AWS Java SDK - are updated too frequently, leading to excessive numbers of PRs. In order for Scala Steward to deal with that, it would be helpful for Scala Steward to know the release dates of the artifacts it's considering updating.

...some available sources of data

• search.maven.org exposes a REST API that has a timestamp field for each artifact (see eg https://search.maven.org/solrsearch/select?q=g:software.amazon.awssdk%20AND%20a:s3%20AND%20v:2.17.71&rows=20&wt=json), which is great, but unfortunately only useful for artifacts that have been published to Maven Central.
• There's a <lastUpdated> field in the maven-metadata.xml file that's published with each artifact (see, eg https://repo1.maven.org/maven2/software/amazon/awssdk/s3/maven-metadata.xml), but that's not specific to an artifact version - it just relates to the latest published version of that artifact, no good if you want to know about an older one. Here's the code that creates that file.
• Coursier API has a Versions#lastUpdated field which I presume is just the data from the <lastUpdated> field in the maven-metadata.xml file?
• The raw directory listing of an artifact version folder - assuming you can access it - will often give a timestamp against each file- however, this has no standard format, and it's position and datetime format will vary depending on how the webserver is set up:
  • https://repo1.maven.org/maven2/software/amazon/awssdk/s3/2.17.71/ gives a raw text grid, with 2021-10-29 20:53 in the 2nd column
  • https://repo.clojars.org/Hermes/Hermes/0.1.0-SNAPSHOT/ gives 2020-02-09T14:36:26.000Z in the 1st column

Some resources:

• https://www.deps.co/guides/public-maven-repositories/
• https://cwiki.apache.org/confluence/display/MAVENOLD/Repository+Layout+-+Final ...a document from 2005 describing the final design of Maven 2's repository layout. Also:
  • https://cwiki.apache.org/confluence/display/MAVENOLD/Repository+Metadata

See also Retrieving artifact release date using Aether Eclipse, which asked this question specific to just the Aether Eclipse library (now known as Maven Artifact Resolver), whereas I'm interested to know if there is anything that works reliably for obtaining this information.

Slinky

As you already noticed, the maven-metadata.xml is the closest and official approach you'll get. You haven't explain the need for it. In general a timestamp doesn't add value; more important is the comparison of versions. Are they expected to be backwards compatible? – Voguish

thanks @robert-scholte! I've added a use-case to the question. I understand that for dependency resolution the main thing really is version-comparison, but for automated dependency updates (like that performed by Scala Steward) the artifact age really would very helpful! – Slinky

Answer 1

Thanks for this question-which-is-basically-an-answer, with a thorough discussion of the options. I've had success with variant of your third option, accessing the raw directory listing. As well as the file-level timestamp information, there may be a last-modified header. (This is definitely there for maven central, for example.) It's a string, so I assume there's no guarantees on the format, but it should be parseable with most modern date-time libraries.

For example, given the maven central url https://search.maven.org/artifact/io.quarkiverse.renarde/quarkus-renarde/3.0.0/jar, there's a 'browse' link on the right-hand side which takes you to https://repo1.maven.org/maven2/io/quarkiverse/renarde/quarkus-renarde/3.0.0/. Doing a HEAD call on that endpoint gives you the headers (or you could just do a normal GET call and then look at the headers).

The timestamp returned in the json from the Maven API and the timestamp in the header differ by a few hours, but normally for releases we don't care about the exact hour.

In javascript (just as an example), given an object with the maven gav information, that logic would look like this:

const url = `https://repo1.maven.org/maven2/${coordinates.groupId?.replace(/\./g, "/")}/${coordinates.artifactId}/${coordinates.version}/`
const listingHeaders = await axios.head(mavenArtifactsUrl)
const lastModified = listingHeaders.headers["last-modified"]
return Date.parse(lastModified)

Koran

The last-modified header does not seem to be consistent with the actual release date of a given JAR. For https://repo1.maven.org/maven2/org/codehaus/plexus/plexus-interactivity-api/1.0-alpha-4/, last-modified is a date in 2020, while the actual JAR was released in 2005. – Eliason

I m getting 0 entries in "connection.getHeaderFields() ; and connection.getRequestProperties() ;" – Soni