Anyone into forking this project to get its issues fixed?

[MichaelTurbe]

At present this library is a security threat and looks abandoned by its owner. It's probably the only real option for folks who don't want to pull passport into their projects. What are thoughts on forking it to get it cleaned up?

[mcab]

Hi!

I'm actively working to address the outdated dependency in #215. I'm taking this slow, given that this affects how check_saml_signature works, which is used for returning or rejecting the signed data. Flaws introduced here would be harmful.

Any extra eyes on helping close this and any outstanding PRs would be well appreciated.

[mcab]

I've addressed the outstanding security vulnerability with #228, and the subsequent 3.0.0 release wraps this up.

38927a6

Feel free to reopen this issue / open other issues if you do not believe the concern has been met.