gbirke / rememberme

A PHP library that implements secure "Remember me" cookies
MIT License
125 stars 30 forks source link

Maintenance status of this library #49

Open m-ober opened 3 years ago

m-ober commented 3 years ago

I'm actively using this library and interested in further improving it - see my open PRs: https://github.com/gbirke/rememberme/pulls/m-ober

@gbirke, are you still interested in maintaining it? If not, I would be happy to help out. It seems this library is still somewhat used, so I would like to avoid going for a fork, which likely I'll be the only one using.

gbirke commented 3 years ago

Thank you for reaching out! I must admit that I haven't used or needed this library in a while in my own projects, most of them are private single-user without authentication or rely on existing framework code. If you would like to maintain this, I'm happy to transfer ownership to you or give you more permissions as a co-maintainer. I haven't done this before, I'm not sure how to do this without disrupting existing composer installations. Do you have a suggestion?

Thank you for providing all the pull requests, I have merged most of them. When you rebase #43, I'll create a new release afterwards.

m-ober commented 3 years ago

Thanks for getting back to me so fast (and merging the open PRs)!

I haven't done this before, I'm not sure how to do this without disrupting existing composer installations. Do you have a suggestion?

As for the Github repository, there is a pretty straightforward way to transfer it (this will also keep forks etc. intact): https://docs.github.com/en/github/administering-a-repository/transferring-a-repository

As for composer, I see two ways:

  1. I can create a new package under my namespace, you can then abandon yours and enter the new package as replacement. This way users will be notified when running composer and they can switch to the new package. Existing installations using old(er) versions will keep working without disruption.
  2. You add me as another maintainer on packagist. Users do not need to update their composer.json - but maybe you no longer want it to be associated with your name(space). It may also be confusing if repository and package are in two different namespaces.

What do you think?

When you rebase #43, I'll create a new release afterwards.

Done. As support for PHP 7.2 was dropped and a class name changed (Redis -> RedisStorage), I'd suggest a major release (even though the last release was also a major release).

alexweissman commented 3 years ago

For what it's worth, we're definitely still using this package: https://github.com/userfrosting/UserFrosting/blob/master/app/sprinkles/account/composer.json#L24.

gbirke commented 3 years ago

I can create a new package under my namespace, you can then abandon yours and enter the new package as replacement. This way users will be notified when running composer and they can switch to the new package. Existing installations using old(er) versions will keep working without disruption.

Thank you for this offer! I have done some housekeeping to make all the CI tasks work again and created a new release (4.0.0). When you have cloned it, I'll mark this repo as abandoned and yours as the replacement.

m-ober commented 3 years ago

Sorry for taking an awfully long time. I should now have more time again for hobby projects and have created a new Composer package under my namespace:

https://packagist.org/packages/mober/rememberme

Also I switched from Travis to Github actions. In the long term, I don't plan to go for BC breaking changes, but to keep the library up-to-date for new PHP versions (next up is PHP 8.1, once released) and fix critical security issues, should they arise.

If you still want, you can mark birke/rememberme as abandoned and set mober/rememberme as replacement.

m-ober commented 2 years ago

Hey,

I released a v5.0.0 version of this package with a lot of small tweaks and also with a possible solution to concurrency issues, you can read about it in the README:

https://github.com/m-ober/rememberme#upgrading-to-version-5x

I don't know what your current sentiment regarding this library is, but I would still like to somehow have a "migration path" for existing users.