Project status / is Retrofit abandoned ?

[Gaibhne]

It seems that despite some activity commit-wise and issue/comment-wise, releasing anything in this project has come to a complete halt over two years ago. The dependencies are also showing their age, with the OkHttp being used in the last release being version 3, whereas the development over there is currently close to releasing 5.0.

I understand that open source software is basically free work gifted to us by the contributors, and by no means do I wish to imply we are in any way owed updates!

But it would be very helpful to all of us if there was some sort of clarification on the state of the project - is it on life support/maintenance, with bugs only fixed in snapshot releases and no further planned development ? Or did releasing change somehow and there are newer releases elsewhere ? Should I still consider Retrofit for future projects, or is it better to only use it in legacy projects, or possibly plan to move away there as well ?

[JakeWharton]

Most of your points are addressed here on a similar discussion: #3753.

Unless there are major bugs that crop up requiring immediate attention, the project is stable. As you've said, we are still dealing with issues that are created and even merging some changes. There will not be a release any time soon. Maybe early next year when things slow down on other projects but our attention is elsewhere.

Does that address everything you're worried about or did I miss anything?

[Gaibhne]

No, that's a very exhaustive answer, thank you. I would still recommend putting something along those lines in the readme, as I noticed other people were also confused about the project status. I am facing a bug, which must be due to either Retrofit2 or OkHttp (a client level interceptor in the HttpClient used by Retrofit is only called after the request is made, rendering Auth header injection impossible), but I have not yet been able to narrow it down enough to open an issue over it - updating dependencies is usually my go-to, before spending too much time narrowing bugs that might already be fixed in a current release ;)

[cj-marius-duna]

Security issue: Information Exposure #4083
There are some security fixes need to be addressed:

https://security.snyk.io/vuln/SNYK-JAVA-COMSQUAREUPOKHTTP3-2958044