Status of the project and new maintainers needed

[arnowelzel]

Status of the project and new maintainers needed

[arnowelzel]

Thanks to @florian-forestier we have support for NC 28 now!

[arnowelzel]

I second that this project as is has no real future. I'm glad to handover to someone who sees otherwise but will archive this in a couple of months otherwise.

Since we managed to get an update done for NC 27 which also includes the new application structure and fixes #205 as well, it may make sense to keep it a bit longer as long as KeeWeb itself works. But otherwise I agree - without any active development of the upstream KeeWeb it will break at some point.

[JoshuaPettus]

Hey, just wanted to thank you guys for giving the app another gasp of life before it ceases to be.

[arnowelzel]

@tilllt Keeweb-Nextlcoud is still maintained as far as possible. However since the upstream did not get any updates in the past, it was neccessary to let users know about the situation. Maybe we'll update the notices about that so people know, that the situation may change in the future. However, so far we have to wait.

Yes, I have seen the recent activity at https://github.com/keeweb/keeweb/commits/master/ as well. However, I'll wait until there is a new release which is proven to be trustworthy.

[jhass]

I second that this project as is has no real future. I'm glad to handover to someone who sees otherwise but will archive this in a couple of months otherwise.

[ann0see]

There's a new PR claiming to fix compatibility with the latest Nextcloud version.

[arnowelzel]

I merged the PR and will check if we can at least provide an update for NC 27. However the main issue remains: the upstream project is not maintained any longer and #205 also needs some attention. The latter one is not a breaking change (yet) in Nextcloud but will cause a lot of log entries if debug logging is enabled.

[goebbe]

There should be a big warning!

As much as I regret it, the upstream KeeWeb project is completely unmaintained since July 2021!
KeeWeb is not simply in maintenance mode, it is completely abandoned since.
Since KeeWeb relies itself on quite a few upstream packages and libraries and nobody is actively monitoring for security problems or updating packages there is a growing security risk. Even if security problems are fixed since 2021 in these libraries, these fixes are not integrated into KeeWeb and probably never will be.

Unfortunately nobody took up the development, since 2021, so I believe it is unlikely that KeeWeb will have any future.

Please consider to put a deprecation warning for the nextcloud-keeweb project.

[arnowelzel]

Please consider to put a deprecation warning for the nextcloud-keeweb project.

Yes, this would be a good idea for the time being.

@jhass Since you are the owner of the store entry - it may be a good idea to add a warning to the story entry similar to the one in https://apps.nextcloud.com/apps/documents:

💀 KeeWeb not actively maintained since 2021 and may contain security issues 💀 Please move to an actively maintained developed app like Passman or Passwords.

[jhass]

As far as I understand the appstore description is pulled from https://github.com/jhass/nextcloud-keeweb/blob/master/keeweb/appinfo/info.xml#L7-L9 actually. Feel free to add any notice there, the next release should update the description.

[tilllt]

I don't know if something about the situation changed recently but I can see several commits to upstream Keeweb from the last weeks. So it doesn't seem unmaintained after all?

Does this mean that Keeweb-Nextcloud itself is unmaintained now, but not for the fault of an unmaintained upstream Keeweb, or could someone please clarify the situation?

[goebbe]

@tilllt The new developers seem to be quite active - but there are a lot of outdated dependencies and bugs to catch up with.
Since password managers store sensitive information, it is probably a good idea to follow the activities and let the new devs. built some trust. I keep my fingers crossed and hope the best for keeweb.