Is the jose module being deprecated, and when?

[MajorDallas]

I just noticed this message on the JOSE index page:

We are splitting the jose module into a separated package. You may be interested in joserfc.

Assuming joserfc is production-ready now and "split" means removal of authlib.jose, how soon the split will occur may affect decisions about when to refactor existing code or which module to use in new code. I went looking through the authlib.org blog, recent release notes, issues, and PRs for more details, but haven't found much.

The key questions are:

1. Will authlib.jose be deprecated and eventually removed?
2. Has a timeline for that deprecation been decided and, if so, what is it?
3. Is joserfc considered "production ready" as of release 0.8.0 (the most recent at time of writing)? "Starting from version 0.5.0, the method names and their parameters are expected to remain stable" (API stability) sounds like it may be ready as long as one only needs basic encode/decode functionality.

[lepture]

I'll address the deprecated details on the documentation.

1. We will use joserfc in Authlib, and add deprecating message for jose module
2. We will keep the jose module until v2.

If you don't want to migrate to joserfc, you can still use it, but with deprecating messages.

joserfc is sort of production ready, there are some details to improve. For now, it has everything from authlib, with better design and type hints. I can say the current version is more robust than the jose module in authlib.

[MajorDallas]

Thank you for the clarifications!