Duo Security

Web SDK v2 Repository Deprecation Frequently Asked Questions

last updated June 24th, 2022

The GitHub repositories will be deprecated July 18, 2022.

No. Duo is only deprecating the older, non-Universal Prompt Web SDK repositories (also known as the Web SDK v2 repositories).

If the repository you are using begins with "duo_universal", it is a Universal Prompt repository and is not affected by this deprecation. It it begins with "duo_api" or "duo_client", that is an Auth API client and not affected by this deprecation. The affected Web SDK v2 repositories are listed below in the "Which GitHub repositories are being deprecated?" question.

For now, yes, Web SDK v2 integrations will continue to function. This deprecation only applies to GitHub repositories for the older, Web SDK v2 clients. However, we recommend upgrading to the Universal Prompt for the improved user experience and additional features. Note that Duo has announced that the Traditional (iframe based) Prompt aka Web SDK v2 based integrations will reach end of life on March 30, 2024.

Yes. The GitHub repositories will be archived, but remain public. You can still fork, clone, or pull from them; though as noted, it is unlikely they will receive any updates.

Yes. This deprecation does not change anything in the Duo cloud service.

Duo only plans to implement new functionality in the Universal Prompt, and therefore strongly encourages that applications migrate away from the older Web SDK v2 clients to the Universal Prompt clients. We are deprecating the older GitHub repositories to communicate that they will not be in active development.

All repositories related to Web SDK v2 integrations that do not use the Universal Prompt. The full list is:

• duo_python
• duo_java
• duo_ruby
• duo_perl
• duo_dotnet
• duo_nodejs
• duo_php
• duo_oam_plugin
• duo_web_sdk
• duo_coldfusion
• duo_wordpress
• duo_classicasp
• duo_jira
• duo_confluence
• duo_splunk

There are a variety of options. Please see our Universal Prompt Update Guide for an overview of the update process.

Duo has published multiple Universal Prompt client libraries, both to GitHub and online package managers:

• Python
• PyPi
• Java
• Maven
• PHP
• Packagist
• NodeJS
• NPM
• C#
• NuGet
• Golang

You can find a step-by-step example of updating an existing Web SDK v2 application to the Universal Prompt here.

Another option for web applications with OIDC support is to use our OIDC-based API. See our documentation for more information.

And for web applications with SAML support, consider implementing the best of both worlds with Duo Single Sign-On and/or Duo Passwordless

Primarily, it means no feature work is planned on the GitHub repositories. It is also unlikely that any new versions will be released, except in the case of significant security vulnerabilities being found. The GitHub repositories will be archived and no longer accept issue reports or pull requests.

These packages will be deprecated in the package managers. This generally means the packages will remain available for use, but will emit warnings about deprecation. The packages will not receive updates or new releases, except in the case of a significant security vulnerability.

This applies only to the older Web SDK v2 packages, not the Universal Prompt client packages - those continue to be supported. The packages in package managers that will be deprecated are:

• Python / PyPi
• Ruby / RubyGems
• NodeJS / NPM
• PHP / Packagist

Even though there are no replacements at this time, we will still be deprecating this category of repositories. To implement a Universal Prompt integration in one of these languages or applications, you can use the Duo OIDC Auth API described at https://duo.com/docs/oauthapi.