I am deprecating most of my open-source NPM package
I am deprecating most of my open-source NPM packages
This blog post was published on July 29, 2026.
I am deprecating the Arctic NPM package and most NPM packages published under the Oslo project.<br>The only package I will continue to maintain is @oslojs/encoding. I am also scaling<br>back the scope of lucia-auth.com. For me, now seemed like a good time to move forward and focus on<br>other projects.
On Lucia, the website and the repository will only contain the code and documentation for what’s<br>necessary to replace the version 3 of the previously deprecated NPM package. I have also archived<br>all example projects on GitHub and I will be shutting down the project’s Discord server by the end<br>of the year. Even with my recent focus on Go, I still want to create resources for JavaScript in<br>the future. However, I think publishing them under as a different project will be the better<br>option.
On Arctic, the NPM package is deprecated. I haven’t touched the project in nearly a year and I<br>can’t see myself working on it in the future either. I’ve decided that it’s better to deprecate it<br>rather than to keep pretending it’s maintained, especially with how much NPM downloads it’s<br>getting recently. As for my personal gripes, first, it has become very bloated with the number of<br>providers. At the same time, I don’t think it’s very useful. The API isn’t tailored to each<br>specific provider’s OAuth 2.0 implementation. But my biggest issue is that I don’t think I<br>should’ve made the library in the first place. At the very least, I should’ve made a separate<br>package for each provider. However, I think the OAuth 2.0 protocol isn’t an ideal layer to<br>abstract into a library and any library should target an abstraction one or two layer above the<br>it. It’s too tied down to the underlying HTTP protocol and implementations can extend the API<br>however they want. Similar to Lucia, the website now just contains example code for replacing the<br>package.
On Oslo, the NPM packages are deprecated except for the encoding package. The encoding package is<br>used by Astro core and I will wait until the new Uint8Array.toBase64() and<br>Uint8Array.fromBase64()<br>(and the hex encoding equivalent) are available on all actively-maintained versions of Node.js<br>before deprecating it (I expect around 2028). I do think some of the packages like the HOTP/TOTP<br>package have some merit, and I may provide a replacement package under a different name in the<br>future. Technically, I can just do that now, but I’d rather not publish packages that I don’t have<br>immediate uses for them.
Thank you to everyone who has contributed to these projects.