Required dependency tijsverkoyen/akismet is abandoned about silverstripe-akismet

[emteknetnz]

One solution, which is probably the easiest solution, is we just copy the abandoned repository into a new /thirdparty folder in this repo. Looking at the LICENSE.md, I don't see any reason not to. @maxime-rainville what do you think?

[maxime-rainville]

Looking at tijsverkoyen/Akismet, it's a pretty small packages.

We've used the "thirdparty folder" approach in the past for dependencies that had never been shipped in a composer package and usually didn't have any namespace and were contain in a single file. I don't think that's the best solution here.

I would suggest those possible solutions:

• Remove dependency on tijsverkoyen/akismet, duplicate all the classes into our own namepsace, and update all references to use our own classes.
• Copy tijsverkoyen/akismet into this module, add a PSR4-autoloading entry for it to our composer file and a provide statement. Maybe add a warning to say ... those classes are in the module but we don't consider them part of our API.

In theory, we could fork tijsverkoyen/akismet but I don't want to be stuck maintaining the library for non-Silverstripe-CMS projects.

[maxime-rainville]

Might be worth pointing out that there's noting blocking the installation of an archived packages ... although it's not a great look when you start a new project and you see a bunch of warnings that you are using unmaintained libraries.

[dhensby]

I'm not really too concerned that is abandoned. It's not been updated in ~6 years and it never concerned anyone, so the fact it's just formally abandoned now isn't a big deal.

If we think it's a really big deal we can implement our own API interaction, because that module code needs a bit of modernisation

[maxime-rainville]

The problem is that tijsverkoyen/akismet is on our list of supported dependencies. So we have committed to look after it which puts us into a somewhat awkward situation.

Adding it there was probably a bit dumb. What we should care about is silverstripe/akismet, not any underlying library it might uses.

[dhensby]

Hmm, indeed - hard to claim to support a library we have no rights to.

Looks like the list needs updating and possibly the API logic just re-written for our module