Status of this project

[jankapunkt]

I didn't want to open this as an "issue" because it's rather a thing of perspective.

@kelektiv How do you see the continuation of this project? I personally find the silence around many of the recent issues and pull requests a bit concerning.

At the same time I see few to no real alternatives to this package if one wants to stick with bcrypt.

How can we ensure the future of this repository and avoid worst case scenarios (aka abandoned with high adoption plus open vulnerability)

Are there anything we as community can do to support?

cc @minenwerfer

[recrsn]

There is no vulnerability reported against bcrypt. Some of them are against dev dependencies.

[jankapunkt]

I didn't intend to imply that there is or provoke any FUD. This discussion is entirely putting it into perspective (proactively) as a realistic scenario.

I just want to make sure that apps and Frameworks we use that depend on this package are to be prepared for this scenario. The priority of such preparation depends on the current state of the package and as I pointed out there is currently some silence around issues and pull requests.

Being a maintainer myself I understand there are times where non critical things may not get attention and communication can also not be ensured. This is why I opened a discussion rather than an issue.

Finally this is also an offer for contribution from my end and people I know from the community I am involved.