I wanted to follow up on today's discussion on the board of directors call, but first I have read a little bit of your mailing list archive, and that has changed what I was going to say.
Over the past year, the project has reported, in almost every board report, that the project is inactive and planning to retire. But then I read the last few months of email to this list, and it appears that the actual project community has no such desire. Mostly I want to commend you for having that conversation and putting the user community first. To be clear, there is no obligation to produce releases in order to continue to operate a user-centric project. If you have users that rely on you, and you have an active community (where "active" is defined as 3+ PMC members able to respond in the case of a CVE, and folks who are available to answer user questions) then you still have an "active" project. That said, it's worth noting Chris Dutz's comment on your board report, regarding the BlazeDS sub-project and its Log4J dependencies. He suggests possibly investigating passing that sub-project over to Royale, if there are not sufficient people here to address that concern. Anyways, please do reach out if you have any questions. But know that "active" has many different possible definitions, and that projects are not obligated to meet every bar in order to be serving their user community. --Rich, for the Board of Directors.
