Future and present of Prototype.js

[Sublime1]

In light of having to fork Prototype.js in order to maintain compatibility with Vue.js, I had a few questions on the state of this project, especially after reading savetheclocktower's comment here about the project not doing further releases. I'm not aware of any historical discussions that may have been had in the past, so forgive me if I'm re-treading old territory, and feel free to point me to past discussions. For such an historic, and still widely-used project, some clarity would be good.

Have there been discussions in the past about handing over the project to new maintainers? There seem to be plenty of PRs from people capable of keeping the project alive. Was it that nobody could be found who was willing to take over the project, or were there other reasons for not relinquishing control?

Is there a community fork out there that people could be pointed to? If so, could this be mentioned in the README?

Since the project at the moment is not being maintained, it would be good to communicate this to the community and provide clarity to future users. This could be done by archiving the project, which would mark it as read-only. It might also useful to update the README to reflect this, with any relevant reasons behind the decision that should be publicly known, and the known current risks of using the library. It might also be useful to document any known issues/workarounds, such as the most recent CVE and Array.from issues.

Thanks to everyone who has done great work in the past to keep this alive, and looking forward to any discussion.

[savetheclocktower]

Thanks for opening this issue.

The complicating factor here is that Sam Stephenson has fallen out with his former employer and rues the work he did while he worked for them. I support that sentiment in spirit, but it's easy for me not to contribute to Prototype myself when it's been eight years since the last release. Based on what he's said publicly about this, I think I'm doing him more of a favor by excluding him from this sort of discussion than by including him — which is why I'm not even mentioning his GitHub handle in this comment.

In the interest of lowering page weight, I — feeling wistful — removed my own website's dependence on Prototype last year. I was able to reduce the heavy usage of Prototype library functions to a handful of helper functions that wrapped around native browser APIs. I'm proud of Prototype and of my contributions to it, but I wouldn't recommend that anyone use it these days if they were starting a new website. Still, I understand that legacy websites and web apps would benefit from compatibility releases.

Because it's been so long since the last release, I have no idea who I'd contact to get a new release hosted with Google Hosted Libraries. I would've sworn that that service was discontinued, except that it's got the latest release of jQuery, so someone's still presumably the contact person at Google — but I don't know who. I'm not enthusiastic about that legwork, but if someone else wanted to do that, I'd try to point them in the right direction.

The repos in this organization are the work of @jwestbrook — before they existed, all activity happened on Sam's personal account. Because of @jwestbrook's history of contributions, if he wanted to take the reins on security and compatibility fixes, I'd have no qualms about new patch releases going out under the Prototype name. (If he didn't want that responsibility, I wouldn't blame him at all.) If someone else wanted to fork Prototype to evolve it and add features, rather than just fixes, I'd suggest that that happen under a new name and a new organization. I'm not aware of any such community fork that already exists, but I think it's a good idea.

[jwestbrook]

Andrew (@savetheclocktower), I don't know what to say. I don't consider my contributions as big as the rest of the other developers that were(are) part of Prototype's history. But I really appreciate you saying what you did.

[walterdavis]

@jwestbrook it's well deserved, speaking as someone who has been here since 2005.

[Sublime1]

Hi Andrew

thanks for taking the time to respond. I really appreciate your frankness on the reality of the situation. I'm not familiar with the history of the project, but like many, find myself the custodian of an legacy codebase that is running along happily with many happy customers. All we need is to keep this thing alive for a few more years. The conversation in the Vue.js compatibility issue I raised actually got a lot of love, so I suspect there are a lot more people out there like me. I don't know how accurate those usage statistics I quoted are, but they were certainly indicative of a lot of systems out there still running Prototype. Of course, I don't expect anyone to be using it for greenfield development, but that's OK. I can see from previous PRs and issues that you had more ambitious plans in the past, but I think for now, what's needed is "just" security and compatibility releases.

As I said in my initial comment, I think what's needed is clarity. There is a certain duty of care to hand things over when we reach the natural end of the road. This frees up the next person who wishes to take up the reins. It would be amazing if Jason wanted to be that person (he's clearly in the best position) but probably most important is that clarity is provided on the various public pages of the project. A project with such an illustrious history deserves to be properly sunsetted.

I don't think I have the technical skills to help out much, but I would certainly be happy to do what I can in a dogsbody role. Here's my first contribution - regarding a Google Hosted Libraries contact they are responding to people in this forum e.g. see the response from Philipp Wollermann in the latest thread. I believe this is the same person.

Thanks for listening.

[savetheclocktower]

@jwestbrook, do you know how to update the website? I can't remember if you've needed to in the past. That's probably the first step. If a new version can be tagged in GitHub and linked to from the website, that'd be enough to get it hosted on Google Hosted Libraries.

[jwestbrook]

@jwestbrook, do you know how to update the website? I can't remember if you've needed to in the past. That's probably the first step. If a new version can be tagged in GitHub and linked to from the website, that'd be enough to get it hosted on Google Hosted Libraries.

No, I just have the API documentation pointed to the repo in my github account. Also the domain name/ssl issue is still a problem that I can't fix (#352) for both api and www.

[savetheclocktower]

I remember being astonished that we were able to do that for the API documentation. What was the trick? Would it work for the main website? (Not surprised about HTTPS, but we can take these one at a time.)

[jwestbrook]

I remember being astonished that we were able to do that for the API documentation. What was the trick? Would it work for the main website? (Not surprised about HTTPS, but we can take these one at a time.)

I had a virtual machine still built that had the legacy version of Ruby that the documentation requires to build. Also whomever had the api.prototypejs.org domain attached to their github account/repo apparently removed it so I was able to claim it. And since the DNS records still pointed to the github pages ip's it just started working ( except the SSL part).

I assume updating the main website is through the https://github.com/prototypejs/prototypejs.github.com repo ? It looks like I don't have permissions for that repo.

[savetheclocktower]

I figured you had permissions for everything. Let me see if I can fix that. I'm also going to see if I can get that repo running and building because it is probably using a 14-year-old version of Jekyll. With any luck I'll at least be able to create some runbooks for common tasks.

[savetheclocktower]

I was able to make the changes necessary for the prototype.github.com repo to build and deploy properly with the latest Jekyll (4.3.2). I made a small change to a stylesheet and was able to confirm that that change got deployed and is reflected in the browser. The config changes and the new Gemfile are now present in the repo.

I am gobsmacked at how easy this was.

@jwestbrook, I seem to remember that you're on Windows, but if you can run Ruby 3, I'm guessing you'll find it pretty easy to update the website. That's one task off the list.

[jwestbrook]

I was able to make the changes necessary for the prototype.github.com repo to build and deploy properly with the latest Jekyll (4.3.2). I made a small change to a stylesheet and was able to confirm that that change got deployed and is reflected in the browser. The config changes and the new Gemfile are now present in the repo.

I am gobsmacked at how easy this was.

@jwestbrook, I seem to remember that you're on Windows, but if you can run Ruby 3, I'm guessing you'll find it pretty easy to update the website. That's one task off the list.

@savetheclocktower I have both for different tasks. When I was doing the API Documentation build I had more success installing the legacy Ruby versions on Windows though.