How to Deprecate a CPAN Module

markdownlint-disable MD003 MD033 MD046"This old house once filled with joy" by Don O'Brien is licensed under CC BY 2.0.

You may have noticed that the CPAN Security group recently got funded by Alpha-Omega to work on further securing the Perl and CPAN ecosystems. This means that A LOT OF CVEs are currently being issued. Since the group is not the arbiter of which modules are still in use (and this is largely an unknowable problem), there will be CVEs published for modules which probably can simply be deprecated.

Deprecating a module on CPAN is not as simple as pushing a button, so let’s run through what’s actually involved. The key thing to know here is that to deprecate a module you have to upload a deprecated version. This may seem counter-intuitive because uploading a new archive makes it look like the module is still under development, but none of this is going to change anytime soon. File it under “historical reasons” and get on with your day.# First Consider Adoption

If you have decided that you no longer wish to maintain a module, you can mark it as available for adoption. This does not require a new upload and can be done directly fromPAUSE. If you’re going this route, you can still upload a fixed version or you can wait for someone else to adopt and fix the code. If a module is still useful or has dependencies you may want to consider this option as more beneficial to the community. You are not required to hand off your module and, likewise, you are not required to deprecate it. It’s always your call to make. You can also choose to fix it or to do nothing at all.# Choosing to Deprecate# Flag the Module as Deprecated

Step one is flagging the module as deprecated. When I searched for resources on how to do this I, of course, found thatNeil Bowers had helpfully already mapped it out, way back in 2015 in hisMarking a distribution as deprecated blog post. That will walk you through the steps required to do the flagging. If you prefer to invoke an…