Track "successor" package [was: Incorrect Package data]

[johnmhoran]

Some of the data we have in the database for Package versions is incorrect. Examples include:

• pkg:maven/log4j/log4j@2.17.0

  • As I understand the namespace transition, the 1.x versions used the log4j namespace, e.g., pkg:maven/log4j/log4j@1.2, while the 2.x versions use the org.apache.logging.log4j namespace, e.g., pkg:maven/org.apache.logging.log4j/log4j@2.0.
  • See, e.g., https://repo1.maven.org/maven2/log4j/log4j/, which lists a number of 1.x versions but no 2.x versions.
  • See also this related issue.

• pkg:maven/org.apache.tomcat/tomcat@76.0.77

  • It appears that the latest versions of org.apache.tomcat/tomcat do not come close to reaching 76.0.x. See, e.g., https://tomcat.apache.org/ and https://mvnrepository.com/artifact/org.apache.tomcat/tomcat

[pombredanne]

We will need to track a successor package. See aboutcode-org/purldb#175 for details.

See also #1284