Warehouse: Broken/Unmaintained Python Projects on Pypi.org: Flag and then Remove after 30 days

[jeff00seattle]

What's the problem this feature will solve?
There are many Python project submitted years ago, for example, jagged, that may have worked fine 2+ years ago, but have not been maintained since initial uploaded 2+ years ago to Pypi.org.
Example of broken: https://pypi.org/project/jagged/#description
Github code of broken: https://github.com/sdvillal/jagged

Describe the solution you'd like
Such Python project on Pypi.org should be flagged as either Broken/Deprecated/Unmaintained, thereby to notify the owners/maintainers that this needs to be fixed. If not fixed in 30 days, then either Archive/Hidden/Removed from Pypi.org. Such projects are taking up unnecessary space and the Python project name could be assumed by other developers to use for another Python project, or copy the code from GitHub reference by Homepage and fix it and uploaded it under new Owners/Maintainers.

Additional context
Similar request for issue 4004

[webknjaz]

[zsimic]

Agreed, those dead projects are super annoying... they're just polluting pypi.
All old (untouched for 2+ years) should outright be deleted, no questions asked.

Also, there should be a higher standard when publishing to pypi. Projects that are not correctly described shouldn't get a spot on pypi. If a project is a placeholder, there should be a clear tag stating it's a "name reservation"... and there should be a time limit on those (if project doesn't become something effective after say 6 months, it should go away).

There are tons of bogus projects out there... Seems like the first 100+ on https://pypi.org/simple/ are trash just from their name.

[webknjaz]

There are projects, which are complete and don't require any updates, because they do their job well. No questions asked? Sounds insane to me. Moreover, such projects might be dependencies of other high-level things, which you're going to break with your suggestion.

[zsimic]

I guess I'm thinking of stuff like this:

• https://pypi.org/project/pyget/
• https://pypi.org/project/install/
• https://pypi.org/project/package/
• https://pypi.org/project/1337/
• https://pypi.org/project/sample/
• https://pypi.org/project/foo/

Perhaps a ping to the author, that they have to at least say "this project is alive" once a year somehow, by publishing something, or going to pypi and pressing a button (last acked alive: date).

[pradyunsg]

If you're referring to name squatting, we have an existing policy documented in PEP 541 that does outline how to deal with such projects.

[zsimic]

Yes, there seems to be name squatting, uploads that people did to try stuff out, and dead projects. Would be awesome if that was cleaned up.

[zsimic]

Another example is https://pypi.org/project/PrettyTable/ which I actually used recently, not realizing it was a dead project... then tried the slightly more recent (but probably as dead) https://pypi.org/project/PTable/
I wish I could have a way of not wasting my time with dead projects

[zsimic]

Looking forward to PEP 541, great proposal!

Another one that wastes my time: https://pypi.org/project/piptree/ (dead project, has syntax error) when I really want is https://pypi.org/project/pipdeptree/
Every now and then I pip install piptree by mistake...

[webknjaz]

Another example is https://pypi.org/project/PrettyTable/ which I actually used recently, not realizing it was a dead project...

Looking at maintainers list I'd suggest that it's likely heavily used by OpenStack. There's difference between being dead and being used by specific circles of people (and lacking docs, for example).

May I ask you how many projects you maintain (1) on pypi and (2) just on the internet (GitHub)? I think that maintainers of at least a few projects should have the power to decide whether smth deserves deletion. I'm starting to get scared of what may happen if lots of users with similar ideas will be main influencers of such removals. It'll lead to broken ecosystem, closer to what happened with leftpad a few years ago.

(I hope this doesn't sound too aggressive, I just feel bad about possible consequences)

[timkpaine]

name squatter: https://pypi.org/user/suroegin/

[dreua]

Any news on this topic?
Another example of a broken unmaintained package where even the author's email is dead (why did I even bother trying...): https://pypi.org/project/bencode/

[dreua]

I didn't learn anything, tried again and failed again. Also dead: https://pypi.org/project/BitTorrent-bencode/
Also bounces: [email protected]

[di]

Since this issue was first created, PEP 541 has been accepted and implemented.

Aside from that process, PyPI has no plans to archive, hide or otherwise remove any existing packages.

• If you'd like to acquire a broken/unmaintained/squatted package: file a PEP 541 request here
• If you'd like to report a user squatting on a large quantity of package names: email [email protected]