Document that there is no support for Twilio 5 PHP library

Added note about twilio-php version to README.txt.

MAde a small correction to previous patch and rerolled it.
Changing component to "Documentation".

Please maintainers accept this patch until the module is updated to use v5 of the Twilio PHP library. I just spent several hours troubleshooting and this simple documentation patch would have saved me all that time.

To be clear: the tfa_basic module will not work with the latest Twilio PHP lib. In fact, you have to use a rather old one. But the documentation & readmes never say that. They tell you to just grab the most recent version. Not cool. Once I found this suggested patch, I downgraded the lib to v4.9.2 as this patch suggests and bam, the whole thing immediately started to work.

@gnosis,
if you're happy with the patch, it may help to set its status to "Reviewed & tested by the community". I can for obvious reasons not review my own patch.

This documentation fix would have saved me some debugging/time. I think it looks good, so I'm changing the status to RTBC.

Hi
Do you know where i can find the 4.9.2 library ?

THX

Twilio documents where to get it: https://www.twilio.com/docs/libraries/php#accessing-the-4x-version-of-th...
Either use composer:
composer require twilio/sdk:4.11.0
Or get it from Github: https://github.com/twilio/twilio-php/tree/4.11.0

This fix doesn't seem great to me.

What about upgrading the code to work with the Twilio PHP library version #5?

Present state of having Twilio's own code warn of deprecation is better IMO than updating module readme to suggest outdated code. I would consider temporary notice if there was a replacement to Twilio v5 in progress. Otherwise I'm more of the mind to won't fix this issue but will leave open for more discussion.

I would consider temporary notice if there was a replacement to Twilio v5 in progress.

An upgrade of the library API is a different issue. Obviously, it would be great if somebody stepped forward and offered to do the work necessary to upgrade to Twilio SDK 5. Unfortunately, there isn't. If somebody is willing to do this work, I think a separate issue should be opened for tracking this task. I.e., it should not be conflated with this one.

I do not understand the reasoning behind your reluctance to document a problem and a stopgap solution for said problem until someone commits to fixing the problem.

The patch for README.txt is obviously a stopgap solution to help those users (see comment #4) that needlessly spend hours trying to figure out where to find the correct version of a library. Fixing it will not stop the underlying problem (the module requiring an outdated verson of the library) from being fixed.

Otherwise I'm more of the mind to won't fix this issue but will leave open for more discussion.

That is of course your prerogative, as maintainer of this module.

However, when setting an issue to "Needs work", I believe you should be more precise about what "work" you think is needed. As for me, I can't see how my patch can be improved, but I am open to suggestions.

Agree with @gisle. I was one of those users who needlessly spent time trying to figure out the correct version needed.

I can't speak for Ben, but here's my thoughts about this:

I do not understand the reasoning behind your reluctance to document a problem and a stopgap solution for said problem until someone commits to fixing the problem.

I definitely agree in general that providing a workaround is great when a code change to achieve the same goal is going to take some time.

However, providing a workaround hides the real problem and decreases the impact from the real problem: the module needs to be upgraded to work with a supported library version. We have no idea why Twilio has deprecated the still-working library code. It could be due to security issues which would be really sad/ironic if the TFA module is recommending an insecure library. It could be because the 4.x version uses the API in a deprecated way that is going to be dropped without warning.

In this case, I believe changing the instructions as proposed here hides a problem. It obscures tech-debt that people may not know they are taking on. Hiding the problem does a disservice to people who want to use a secure, supported module.

I'm not sure why you feel so strongly about this issue not being about upgrading, but I filed #2997261: Support latest version of Twilio library for that.

I'm not sure why you feel so strongly about this issue not being about upgrading,

I don't have any strong feelings about it. I just wanted to point out the fact that this is issue is not about upgrading.

but I filed #2997261: Support latest version of Twilio library for that.

Excellent.

I fully understand your concerns regarding "hiding the problem". The solution, IMHO, should not be to keep quiet about the problem (as coltrane seems inclined to), but instead to expand the advisory text in README.txt to point out that the proposed workaround may be problematic, since version 4 of the library has been flagged as depreciated by its author, that using a depreciated library may be insecure, and that the library is unsupported and may stop working without a warning.

I've updated the notice in the README.txt to include a caution about the library required being depreciated and the associated risks, building on comment #13.

Please review.

OK, that seems like a step in the right direction.

One nitpick: depreciated is different than deprecated. In a financial sense the asset has likely depreciated on Twilio's balance sheet, but in terms of software release cycle it is deprecated :)

Rerolled patch to correct misspelling pointed out in #16.

Please review.

I'm going to put a warning on the project page of TFA Basic and then close this. I think any energy focused on this problem is best on https://www.drupal.org/project/tfa_basic/issues/2997261.