Inquiry About the State of Maintenance for crewjam/saml

[wz2b]

First, thank you for creating and maintaining this library. It has been incredibly helpful in my projects, particularly as I work on building a custom SAML2 SP. Crewjam/saml strikes an excellent balance by handling much of the SAML2 protocol complexity while allowing for customization, such as JWE support and tailored token exchange workflows. Judging from the activity here, it seems many others find the library just as invaluable.

That said, I’ve noticed some indicators that leave me wondering about the current state of maintenance and feature development. For instance:

• There are 62 open issues, some dating back to 2018.
• There are 30 open pull requests, and the most recent commit to main was several months ago. Many of them are bug fixes, a few are security-related, the others appear to be feature requests and small improvements.
• While the most recent release was fairly recent (October 14, 2023), these trends could suggest that maintaining this project is becoming challenging.

As someone who has submitted a few pull requests, I’ve also encountered difficulties contributing. For example, some existing tests appear to fail independently of my changes, which suggests the main branch might have unresolved issues. Additionally, the lack of responsiveness to PRs makes it harder to determine how best to proceed, whether that’s maintaining backward compatibility in my changes or potentially forking.

I completely understand that maintaining an open-source library, especially one that involves security-sensitive code like this, requires significant time and effort, often from contributors who are volunteering their time. I also recognize that this library spans both SP and IDP functionality, which broadens the scope significantly.

With this in mind, I wanted to kindly ask:

• Are there plans for future maintenance or feature development for the library?
• Would the project maintainers consider any strategies to help share the load, such as onboarding additional maintainers, triaging issues, or providing guidance on addressing failing tests?

I deeply appreciate the work that’s gone into this project and would love to see it continue thriving. If there’s anything I or others in the community can do to assist, I’d be happy to help brainstorm ways forward.

Thanks again for your efforts!

[joesiltberg]

Tagging @crewjam just in case this issue hasn't been seen (sorry if you just haven't had time to respond!)

I might be able to help out as well if help is wanted.