Dear Partner Community,
Thank you very much for your engagement with this RFC. It gave us a lot of valuable input. Here is the summary of what we’ve heard and what actions we intend to take based on your feedback.
These are the main concerns and questions we heard from you:
- The current JAR size limit for Marketplace uploads is already too small. It would need to be increased if dependency management was on the Marketplace Partners’ side.
- This change may increase the customers’ effort to make sure they are not exposed to a specific vulnerability.
- Some functionalities provided by third-party libraries are widely used by apps. Taking away these functionalities would be most disruptive.
- The actual impact on the apps of the proposed change can be assessed only after providing a detailed list of changes and EAP.
- Proposed changes might impact Partner’s ability to maintain a single app version to be compatible with upcoming product versions.
- A significant part of API usage comes from dynamic imports, reflection, etc. which might impact Atlassian ability to analyse it.
What will we do with the feedback?
- We will look into relaxing Marketplace artifact upload restrictions to accommodate larger JAR files.
- We will continue discussing the planned API change with the customers to better understand the potential impact.
- We will release the list of libraries removed from the API and have follow-up feedback sessions with Marketplace Partners about the expected impact.
What is coming next?
- Changelog announcement with technical details, including a list of exported and unexported libraries.