Offering to maintain Noggin

Normally, the procedure is to give the existing owner 2 weeks to respond, and then to create an issue here as well.

FYI: Not if the project has been declared unsupported for security reasons. There is a separate procedure for that, please see: https://www.drupal.org/node/251466#procedure---own-project---unsupported

But you're otherwise right: This will need to wait for the Security Team to approve the patch you've supplied. Normally the security team also re-assigns ownership when they're satisfied, put if required, we can do that. Postponing for now.

Also changing component, as the project has no real owner at present.

If I've misunderstood, perhaps that bit of the page needs rephrasing.

I'm sorry. I didn't intend to criticize, but to clarify that the two weeks waiting period you mentioned is off the table in this case and that ownership transfer will happen ASAP after thumbs up from the security team.

I also agree that since greggles is on the ball in the issue queue, an email may not be required.

As for the "the module will follow the normal unsupported module policies". This is wrong, as there isn't a real owner to contact (the "normal" unsupported procedure assumes there is). Thank you for pointing out that it can be improved. I am replacing it with:

Because if the security issue is not resolved within this period, the Drupal security team may publish the details publicly. At this point, the module will follow the normal unsupported module policies, with this exception: When there is not a human owner, there is nobody to contact and there is not a two week waiting period.

So let the guy become maintainer already - 2 weeks? 3 months?

So let the guy become maintainer already - 2 weeks? 3 months?

jshimota01, thank you for the reminder.

There is a patch for the security flaw: #3098700: XSS Flaw that is still waiting for review and approval from the security team. It was created on March 9, so it has been sitting with a "Needs review" status nearly three months. I agree that this is excessive.

This security issue is handled in the open. It would probably help to speed up the process if the users of the project reviewed the patch and provided feedback about whether it resolves the issue or not. It is installed on more than 1500 sites according to the project page.

However, I'll try to contact the security team directly to find out what the situation is and what it is that is blocking this ownership transfer from moving forwards.

I've sent the following email to security@drupal.org:

Hi security team,
I'm a webmaster trying to handle an ownership transfer of the project Noggin - https://www.drupal.org/project/noggin

James Oakley - https://www.drupal.org/u/jamesoakley - has asked for ownership of the project, as it is currently unmaintained/abandoned - https://www.drupal.org/project/projectownership/issues/3118557

He has provided a patch for the XSS vulnerabality - https://www.drupal.org/project/noggin/issues/3098700

That patch has been waiting for a review since March 9.

I am contacting the security team to find out what the situation is. Is it possible for you to review the proposed patch to help move the issue forwards?

bless you! with the test requirements of 8.9 ^ - I'm hopeful James rips this 'back to the future'.

Can we get the status changed from Postponed back to active and get some movement on this?

Looks like that this was fixed back in January 2021 - see related issue: #3098700: XSS Flaw