Can we delete old/obsolete package versions from a 3rd party package JSON file without causing issues?
I'm worried that maybe there are some assumptions about JSON size or complexity that could start kicking in as entries increase. As a data point, I've got 110 releases in my current Arduino-Pico RP2040/RP2350 JSON file (and FWIW thanks to GitHub releases, they should all theoretically be installable even today). Each release has a toolchain for 6 different architectures (actually 2 toolchains for the RP2350, ARM and RISC-V), so it's not a tiny file.
Removing releases that are 2+ years old seems like an easy way to shrink the JSON file, but back when I was working on the ESP8266 3rd party Arduino core I think there was some issue about pruning things.
Unfortunately this can impact users of Arduino IDE 1.x. That IDE series has a strange behavior where it only recognizes the Boards Manager installation of an Arduino boards platform if there is an entry in one of the package indexes for that platform release. So if you remove a release entry from the package index, Arduino IDE will no longer recognize the platform installation under the following conditions:
User is using Arduino IDE 1.x
User has the version of the platform that was removed from the package index installed
The removal from the package index has been pulled to the user's computer (the indexes are downloaded when the user opens Boards Manager so they might have an older copy of the file up until they do that)
The affected user would find that the platform is no longer listed under Arduino IDE's Tools > Board menu.
This behavior is specific to Arduino IDE 1.x. Arduino IDE 2.x and Arduino CLI always recognize all installed platforms, regardless of whether there is an entry in a package index.
There is a potential impact for Arduino IDE 2.x/Arduino CLI users in that they use the tool dependency data from the package index to determine which tool to use for compilation, upload, etc. processes in cases where the platform configuration leaves ambiguity:
However, fairly early in the development of Arduino CLI (and thus also benefiting Arduino IDE 2.x since it uses Arduino CLI), the developers addressed this potential issue by making Arduino CLI store that data inside the platform at the time of installation via Boards Manager, only falling back to using the package index as the source for this information if it is not available in the platform:
So this would only impact users who installed the platform using a version of Arduino IDE/Arduino CLI from before the introduction of that feature.
Note that the primary package index is significantly larger than yours, and the growth is likely at least equal (since Arduino's package index covers multiple actively developed platforms) so it is likely that Arduino would run into any such problem before you.
Note also that the massive and rapidly growing library index is handled well enough. Although that index is used by a different feature, the basic downloading and parsing of all index files is handled by the same systems.