👋 I've been working on vendoring the Fosite library to back a new OAuth server implementation and hit some friction distributing changes into a metarepo since Fosite is pegged on release tag 1.x.x for Ristretto, which breaks earlier versions due to some generics additions. It appears that maintainers of that library have since ported the changes over into a new module (

/v2

). I've validated that the issue can be resolved in Fosite by upgrading all imports to

/v2

and bumping the dependency on

ory/x

to latest (which previously also consumed V1 Ristretto). Before I propose the above PR upstream, I wanted to confirm with the team whether these changes sound reasonable?

yes that sounds perfect

@steep-lamp-91158 have a PR out here! https://github.com/ory/fosite/pull/865 I'm also seeing build(?) failures on the OIDC conformity checks. Suspect it's a product of upgrading the ory/x version but not fully certain

failed to get build context oryx: stat /home/runner/work/x: no such file or directory

generally lgtm, but we have to figure out that ory/x stuff internally

got it, it does appear to fail on >= 0.700 which is the minimal version to get Ristretto V2. if there's a good workaround happy to make the recommended changes.

its related to our new internal monorepo that we use, so there is not much you can do right now

thanks - do you have a good timeframe on when this change can get unblocked?

no, unfortunately not, there is currently other higher priority stuff on the team's agenda