Released version 4.0.0.
The current versions of the different algorithms are as follows:
At the moment, there is a problem with building argon2_elixir on Windows, but that should be solved within the next few days.
Finally, one of the goals of Comeonin is that the documentation is very good. If you feel that any of the documentation is unclear or incomplete, please open an issue / pull request.
I have just updated bcrypt_elixir to version 1.0.
This now has dirty scheduler support, which should make it more scheduler-friendly. For this version, you need Erlang 20 installed, or you need to build Erlang with dirty scheduler support.
If possible by any means, I do not think you should drop non-dirty thus fast. There may be reasons to not update or self-compile OTP while wanting to update a security relevant library as fast as possible.
I should have made it clearer that I’m not dropping support for the non-dirty scheduler version.
Version 1.0 supports dirty schedulers.
Version 0.12 is the ‘old’ version, which is still maintained and works fine, so if someone doesn’t want to update to Erlang 20, they can stay on the pre-1.0 version.
How long will you provide security backports to pre 1.0? Until OTP 19 fades from main distributions repositories?
It reads as quite a large jump… 0.12 to 1.0
If the library is following Semantic Versioning, a jump from 0.x to 1.x indicates that the APIs are not compatible which is indeed the case here.
Yupp, I am aware of that. And it is unclear how long at least security relevant patches will flow back to 0.12.
I’m just asking for a rough estimate of 0.12s end-of-life.
0.12 will be maintained for the foreseeable future, and it is very stable. It is just that it is not quite as scheduler friendly as the new version.
Making the new version 1.0 is meant to prevent developers updating to the new version by accident.
If you have any further questions, please feel free to ask.
A little explanation of some of the changes that came with version 4 of Comeonin – https://riverrun.github.io/projects/comeonin/2017/09/03/comeonin-v4.html
Two things I would like to mention:
First, there is this issue about redesigning Comeonin. I can see arguments for and against the proposed changes, and I would welcome any feedback you might have. As Comeonin is widely used, I want to get as much feedback as I can before making a final decision.
Second, I have set up a patreon page to accept donations. I would like to stress that Comeonin, and the other libraries I maintain, are offered free of charge, but there are times when I cannot spend as much time on them as I would like. If I can receive some financial support, then I will be able to invest more time in their development.