doc(spec): deprecate the dependsOn/open key

[bfabio]

The SBOM or the package manager manifests already declare the open source dependencies, so the key holds a partial and stale copy. Installation requirements go in the documentation and in the deployment scripts.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
publiccode-yml	Ready	Preview	Aug 26, 2026 2:12pm

[bfabio]

@yaml-9000 minor

[yaml-9000]

Thanks for your contribution 🙏

This is now marked as a minor-change proposal to the standard,
this means that old versions of publiccode.yml will still be valid with this change.

Example of minor changes are additions of new keys or making keys optional.

The next eligible voting round will take place on September 30, 2026

cc @publiccodeyml/steering-committee

_{📄 Voting procedure | 📄 Working Group Charter | 🤖 bot commands}

[dptdgi]

While agreeing on the rationale, we need a working alternative before dropping it.

We use this key to have a rough idea of the dependencies.

A first though is to require a key that point to a file/url for a SBOM in a de facto standard, with some conformance requirements, such as ntia, cisa...

https://github.com/spdx/ntia-conformance-checker#conformance

Or also:

https://www.acn.gov.it/portale/en/w/intelligenza-artificiale-il-g7-vara-le-linee-guida-relative-al-software-bill-of-materials-sbom-

Those checks are already encouraged or required by others bodies, and a modern software project should have in place some machine readable tracking of the dependencies.

Those are just first ideas, @valeriocomo and I are thinking about a more detailed proposal but please add you comments on this issue.