Unmaintained dependencies and what to do about them

[javierm]

These are the dependencies currently affecting us:

• Annotator - unmaintained since 2015, we use it in collaborative legislation. It has critical accessibility issues, making its usage pretty much illegal in some countries.
• CKEditor 4 - a version that had been barely maintained for years and reached its end of life in 2023, we use it so administrators or even registered citizens can easily generate HTML content, and we're looking for a replacement (issue Replace CKEditor 4 with a maintained editor #5458).
• Capistrano3-Puma - with its last stable version released in 2021, we use it to setup and restart Puma when deploying to production. This is preventing us from upgrading to Puma 6; we could try using a beta version released in 2022 which added Puma 6 compatibility.
• Errbit - still maintained, we use it as an experimental error tracker on production installations. It requires MongoDB, though, which is no longer included in any major GNU/Linux distributions due to licensing issues. We could replace it with Sentry (issue Replace Errbit/Airbrake with Sentry #5482).

Then there are some dependencies that, while working fine right now, might prevent us from upgrading other tools in the future. All of these dependencies provide key features present everywhere in Consul Democracy, and replacing them would require a lot of work:

• Foundation Rails Helper - mostly unmaintained since 2017, we use it in all the forms which allow people to add/edit content. It might prevent us from upgrading to Rails 7.1 in the future.
• Foundation - maintained from time to time since 2019, we use it pretty much everywhere in our HTML, CSS and JavaScript code. We plan to slowly replace it with plain HTML, CSS and JavaScript, since these technologies have evolved a lot in the past 10 years.
• Apartment - maintained again after its second period of inactivity in the last few years, we use it for multitenancy. Replacing it with the multi-database multitenancy system introduced in Rails 6.1 wouldn't be that hard, but migrating the database content in existing Consul Democracy installations would be complex. It would also make it harder to add new tenants in multitenancy installations. It's also currently preventing us from upgrading to Rails 7.1.
• Globalize - barely maintained since 2019, we use it to store multi-language user-generated (or admin-generated) content in our database. It might also prevent us from upgrading to Rails 7.1.

Finally there are some dependencies that, while unmaintained, will probably keep working for the foreseeable future and don't have any known serious issues:

• Turbolinks - abandoned since 2019, it's used to (supposedly) load the page faster when clicking on a link. We could either drop it or replace it with Turbo (issue Replace Turbolinks with Turbo or drop it entirely #5485).
• RVM1-Capistrano3 - last version released in 2015, we use it to automatically install the necessary version of Ruby when deploying to production.
• Capistrano3-Delayed Job - last version released in 2019, we use it to restart background process when deploying to production.
• Cocoon - last version released in 2020, we use it in forms which offer the option to add images, documents or questions.
• Turnout - last version released in 2018, we use it (do we?) to quickly add a "Down for maintenance" message.
• File Validators - last version released in 2020, we use it to check valid content types and size of attached documents and images; we could replace it with ActiveStorage Validations with relative ease if necessary.
• Uglifier - last version released in 2019, we use it to compress JavaScript on production; we could replace it with Terser with ease, but right now that would make JavaScript compression a bit slower.
• Rinku - last version released in 2019, we use it to automatically convert texts starting with http or https to links.
• Globalize Accessors - last version released in 2021, we use it to simplify code dealing with multi-language user-generated content.
• Delayed Job - still maintained, we use it to send emails. Even though it's well-maintained, Rails developers have released Solid Queue, meaning this gem will probably become obsolete like it happened with Paperclip when ActiveStorage was released.