Android dependencies management

mirror of https://codeberg.org/comaps/comaps.git synced 2026-04-19 06:22:17 +00:00

Table of Contents

This page explains how we manage updates of dependencies on Android to keep users' privacy, stability and security in our app.

Android dependencies are managed by the CoMaps team.

New features

Dependencies can be added by the community if a dependency is required to add a new feature but the CoMaps team can check:

the dependency is mandatory to implement the new feature and developers cannot use another way with existing dependencies
the dependency is compatible with the license of the project
the dependency :
- is maintained (last update was published less than one year ago)
- require the same minSDK version that the app
- doesn't take too much space,
- doesn't ask too many permissions,
- doesn't use too many child dependencies, --> https://github.com/organicmaps/organicmaps/issues/6116
- and doesn't have any trackers

We do not accept PR to only update dependencies, updates are followed by Android developers inside the CoMaps team

Updates of dependencies are checked after the release is published to have enough time to test changes.
To limit regression in our app, there are rules to know when and how updates can be integrated into our app
- We integrate only releases, not release candidates or other unstable versions
- Major updates can be integrated 3 months after the publication of the library update
- Patch/bugfix can be integrated immediately after the publication of the library update
Changelog and app build need to be checked for each major library update

Some libraries are likely to break more easily the app, here is a list of dependencies which require specific attention when we update them:

Each time we update, we create an issue before to list all dependencies which can be update and check changes to measure impact on our app.