Regarding package renaming from github.com/antonmedv/expr to github.com/expr-lang/expr

[PranavPeshwe]

Starting a discussion regarding renaming. The intention is to (at the very least) bring out ideas from everyone.

@antonmedv I currently see two copies of expr in the go package library: old package name, as well as new package name . This is the reason

• Is this intentional? The old package has a last published date of 24th Nov, also the repository is reported as github.com/antonmedv/expr
• At a minimum, please add a conspicuous obsoletion notice to https://pkg.go.dev/github.com/antonmedv/expr
• If no, would it be possible to remove the old one to avoid confusion? Also, make sure to not release the old name because a malicious actor could grab it and serve a backdoored version of the library. I don't know what protocol/strategy needs to be followed when obsoleting a published golang package.

[antonmedv]

Is this intentional?

Yes, as I'm planning on adding more related project to expr under expr-lang org (js parser, editor, etc). See #481

At a minimum, please add a conspicuous obsoletion notice

I'm not sure how I can do it without publishing antonmedv/expr again. Rignt now https://github.com/antonmedv/expr redirects to https://github.com/expr-lang/expr

If no, would it be possible to remove the old one to avoid confusion?

I think it will break old code what uses older version of Expr.

Also, make sure to not release the old name because a malicious actor could grab it and serve a backdoored version of the library.

Please, explain. Only I can publish under antonmedv/expr.

I don't know what protocol/strategy needs to be followed when obsoleting a published golang package.

Me nether 🙃. I added a section in readme about the move.

[PranavPeshwe]

Thanks, @antonmedv .
My question about 'intentional' was retaining two copies (and not about renaming). My phrasing there was off I guess.

If we keep https://pkg.go.dev/github.com/antonmedv/expr active, then we need to make sure that it is at par with https://pkg.go.dev/github.com/expr-lang/expr. If the former lags behind then people who don't move to the newer package will unkowningly keep on using old code. If we could make https://pkg.go.dev/github.com/antonmedv/expr use the git repo https://github.com/expr-lang/expr, then I believe we will get the best of both worlds (i.e nothing will break for users who don't import the new package, and yet they will get the latest updates from the expr-lang repo).
Hope I am not missing anything here.
My intent 100% is discussion and not prescription.

[antonmedv]

Not sure how we can do it with https://pkg.go.dev/github.com/antonmedv/expr
Probably we need to wait until people will update they deps.

[ripienaar]

If we could make https://pkg.go.dev/github.com/antonmedv/expr use the git repo https://github.com/expr-lang/expr, then I believe we will get the best of both worlds (i.e nothing will break for users who don't import the new package, and yet they will get the latest updates from the expr-lang repo).

@PranavPeshwe this is probably not the case as the go.mod declares the package name - those on old package name will get errors when they try to use new go.mod.