This project is back under active development and maintenance!

[thomseddon]

Hello!

After a hiatus following the 3.0.0 release, I'm very happy to say that I will am planning to pick up the maintenance and development of this project. The point of this issue is to outline the plan.

History

3.0.0 was released in August 2017, when the project was already 4 years old, and was the result of a great amount of effort from a number of people in iterating towards a much improved codebase and documentation. Unfortunately, following this all of us who were involved in the release became rather busy with projects elsewhere and were not able to continue to work on the project. As such, we've been stuck on 3.0.0 since then!

I put out a request for maintainers in 2019, although I did receive a few responses I didn't find anyone who was able to start in earnest.
The action that drew most traction was a complete rewrite of the project in typescript in #564 - this was great to see, as was the amount of attention it got which showed there were still a good number of people using or interested in the project.
However, after observation of the progress of that project it's clear that the maintenance is still one of the hardest parts of such a project and I can understand why anyone would struggle to take that on. I realised that another big rewrite really wasn't what the project needed.

A change in my working situation has left me with a little more time to spare, I've been mostly using this on another OS project of mine (https://github.com/thomseddon/traefik-forward-auth) but I'd like to try and pick up this project too.

Plan

In summary:

• v3 - backwards compatible bug fixes only
• v4 - largely backwards compatible fixes and improvements (no code/model changes required)

A lot of people have been lingering on the 3.0.0 release for a long time and has certainly been battle tested. We've amassed over 100 issues and 22 PRs for this release so I would like to make a big effort to give v3 the fixes it deserves. I have already started this by updating all dependencies and releasing 3.0.2 🎉
In honour of the backwards compatibility, I will also be maintaining support for node 4/6/8 in v3.

Due to the nature of the project, most changes do change the server behaviour and so can be considered "backwards incompatible". To help prevent any jarring changes, the plan is for a v4 release which is as backwards compatible as possible. My goal is to keep the integration entirely backwards compatible, so there should be no client code changes required at all for this entire release. We will drop support for EOL node.js version 4/6/8 and plough through as many fixes and improvements as possible.

Thanks for your patience over the years, I'm already enjoying getting stuck back in again!

[Uzlopak]

Will v4 based on v5?

[thomseddon]

No, it will be based on v3 and be mostly backwards compatible with existing code

[Uzlopak]

Is it planned to implement those changes from v4 also in v5 or is v5 now dead?

[mayrbenjamin92]

So are you planning to "throw-away" all of the efforts that went into v5? Isn't Typescript meanwhile the de-facto standard for writing larger JavaScript-based projects?

[thomseddon]

All code has bugs - with v3 we have a somewhat battle hardened release with over 100 issues/PRs raised in this repo outlining many real bugs, doc issues and proposed features.

Whereas v5 is a massive rewrite with significantly less review in comparison - it may address some existing bugs, but will undoubtedly introduce new bugs.

As mentioned above, In the interest of forward momentum I'd like to fix the bugs and make the project better 👍

[jankapunkt]

Thanks a lot for going this path. It's great to see, that I can continue to rely on this package. Is there a way to send a small donation 💰 to show some ❤️

[desaijay315]

We are with you. Thank you so much for the support and the awesome work you are doing?

[Rmannn]

Is v5-dev branch really dead ? As i understand, typescript version is not any more in the roadmap.

It's true, it's important to be backward compatible, but it's also important to move forward and update the code to support latest features of oauth2.

Some of thoses features were implemented in v5-dev and we were waiting for those to be merged. Better typing,
Pkce was also one of them. Can we expect to get it soon ?

You talk about v4, but we didn't see any branch related to it. Is this really planned ?

We know it's important to get help.
How can we help you to move forward ?
We just won't want to write code that is going to be "throw-away" like in v5-dev.

[jankapunkt]

I think it would be great to have a v4 branch and a v4 project that contains all the issues relevant for v4. By doing so we know where to put our efforts in.

@thomseddon what do you think?

[thomseddon]

👍 3.1 will be released next week (3.1.0-rc1 is published on npm now)

The existing next branch was actually pegged for v4 and includes some necessary breaking changes. I'll create a new v4 branch shortly which will be based on the existing next branch, rebased from master/v3-catchup (#629)

I'm hoping to merge the existing PKCE PR into v4 too.

For those that have asked about sponsorship - thank you so much, I'd really like to spend more time on this project (there's a lot of work to do :) and I've setup github sponsorship, so for anyone who would like to help in that way it would really allow me to focus more time into this and would be greatly appreciated.

[gabriprat]

Hi! Any news on PKCE implementation?

[Uzlopak]

This Project is imho again dead.