Considering deprecating and discontinuing package:oauth2

[devoncarew]

This is a tracking issue for potentially deprecating and discontinuing package:oauth2.

General notes:

• this package is published under our tools.dart.dev publisher; for people who are not aware, that publisher is for packages we've authored in order to build various Dart tools (pub, analyzer, ...)
• the support commitment for the tools. packages is lower than for general dart.dev packages ; the packages are triaged occasionally, we may not be able to respond to all issues; essentially, we're ok with people taking a dependency on them but the packages don't have a strong support commitment
• our only use package:oauth2 is from the pub tool; that team doesn't have the bandwidth to maintain this package beyond the parts that they themselves use
• there are 7 open PRs for the package - from the last 3 years - including for things like additional RFCs to support
• there are 30 untriaged issues (no labels), including #126 ("Is this package still maintained?")

Paraphrasing from the above, we don't have the bandwidth to maintain this package as a general purpose solution, and from the issues and PRs, there some clear maintenance technical debt. Given that this package is from the Dart team, people can mis-interpret the intent to be to provide a general purpose or best-of-breed solution.

An alternative to the current situation is to:

• in-line the part of this package that we use into the pub client
• discontinue the package
• let the the community fork and maintain this package (or to otherwise come up with a replacement solution)

We'll leave this issue open for a few weeks while we collect feedback; thanks in advance!

---

Other data points:

• there are ~30 packages that depend on oauth2: https://pub.dev/packages?q=dependency%3Aoauth2
• the current APIs match the use cases of a command line tool, but may not match the server use-case