Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Considering deprecating and discontinuing package:oauth2 #137

devoncarew opened this issue Nov 7, 2022 · 6 comments

Considering deprecating and discontinuing package:oauth2 #137

devoncarew opened this issue Nov 7, 2022 · 6 comments


Copy link

This is a tracking issue for potentially deprecating and discontinuing package:oauth2.

General notes:

  • this package is published under our publisher; for people who are not aware, that publisher is for packages we've authored in order to build various Dart tools (pub, analyzer, ...)
  • the support commitment for the tools. packages is lower than for general packages ; the packages are triaged occasionally, we may not be able to respond to all issues; essentially, we're ok with people taking a dependency on them but the packages don't have a strong support commitment
  • our only use package:oauth2 is from the pub tool; that team doesn't have the bandwidth to maintain this package beyond the parts that they themselves use
  • there are 7 open PRs for the package - from the last 3 years - including for things like additional RFCs to support
  • there are 30 untriaged issues (no labels), including #126 ("Is this package still maintained?")

Paraphrasing from the above, we don't have the bandwidth to maintain this package as a general purpose solution, and from the issues and PRs, there some clear maintenance technical debt. Given that this package is from the Dart team, people can mis-interpret the intent to be to provide a general purpose or best-of-breed solution.

An alternative to the current situation is to:

  • in-line the part of this package that we use into the pub client
  • discontinue the package
  • let the the community fork and maintain this package (or to otherwise come up with a replacement solution)

We'll leave this issue open for a few weeks while we collect feedback; thanks in advance!

Other data points:

Copy link

hpoul commented Nov 10, 2022

Would be sad to see it abonded, i use it in quite a few flutter projects because it's pretty easy to understand and reason about, without many dependencies. Last time I researched alternatives, most were pretty opinionated about how they store credentials, or do it on there own internally, or even try to handle redirects as flutter plugins.
But i guess alternatives or forks would emerge anyway 🤔

Copy link

Same from me, I use it in several projects and also use it in a plugin oauth_webauth. Really sad to see discontinuing this package which is so simple to use and provide so clean pure dart implementation of OAuth2 grant types. I hope a different destiny for this package instead of discontinuing it.

copybara-service bot pushed a commit to dart-lang/sdk that referenced this issue Nov 11, 2022
Also removes package:oauth2 from DEPS (it is now vendored in pub).

See dart-lang/oauth2#137.

> git log --format="%C(auto) %h %s" 65c7f3e..6ac42d7 Use package:vendor to vendor package:tar and package:oauth2 (#3638) blast_repo fixes (#3646) blast_repo fixes (#3644) Refactor HTTP retries (#3325) (#3590) New command `dart pub cache preload` (#3636)


Change-Id: I6d2dffcac67b4bd1c1c91be952cca65c84d85493
Commit-Queue: Sigurd Meldgaard <>
Reviewed-by: Jonas Jensen <>
Copy link

I use this package also, would be pretty sad if you plan to discontinue it

Copy link

ahmednfwela commented Nov 18, 2022

@devoncarew would it be possible to transfer this package under ?
this way the community can contribute to it easier, and issues would be triaged under

even though this package doesn't depend on flutter, we can split it in 2 packages:

  1. under would be the oauth2 customizable protocol package (this one), perhaps with OIDC support as well.
  2. under would be a new flutter_oauth2 package which has platform specific implementations (opening browser, redirection, persistence, etc..)

Copy link

wstrange commented Nov 27, 2022

oauth2 is the cornerstone of modern APIs; It is critical that there exists a good solution here.

If Google can't maintain this repo, perhaps they can fund an organization that will? Like the flutter firebase plugins - which are Google sponsored but maintained by a 3rd party.

EDIT: I know this is a pretty big ask ;-) (Google can't fund everything). But if its a case of "we have money, but not people" this could be a way forward.

Copy link

Very saddened by this announcement.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Status: In Progress

No branches or pull requests

7 participants