Replace webmozart/path-util with symfony/filesystem

[carusogabriel]

Hey 👋🏼

We use your library in our systems, thanks for it!

There's a warning coming from the installation:

Package webmozart/path-util is abandoned, you should avoid using it. Use symfony/filesystem instead.

Is this something @dependabot could help us with?

[maglnet]

Hi :-)

no, i don't think dependabot can help us here, since this bot only checks if dependencies are up-to-date.

But afaik there is only one place, where the package webmozart/glob is used (which needs webmozart/path-util, that's probably here:
https://github.com/maglnet/ComposerRequireChecker/blob/3c34aa169eb3a4841a293c34d8062e6df6573020/src/ComposerRequireChecker/FileLocator/LocateFilesByGlobPattern.php

So maybe if this glob patterns can be managed by symfony/finder (no need to use the whole symfony/filesystem) the effort to switch should not be that big.

[Ocramius]

FWIW, if there's a non-symfony solution to that, it could be a better approach: mostly worried about dwindling package quality and continuously increasing dependency ranges in symfony/*.

I'd suggest reporting an issue in webmozart/glob directly: https://github.com/webmozarts/glob/blob/539b5dbc10021d3f9242e7a9e9b6b37843179e83/composer.json#L13

I'm keeping webmozart/glob maintained meanwhile, so that shouldn't be a problem, as long as we swap out abandoned dependencies over time.

[machitgarha]

@Ocramius, reminder: symfony/filesystem is already a soft dependency (realized thanks to graph-composer). Not sure if it's a dev or not, however.

[Ocramius]

It's due to dev dependencies: in general, less symfony is a good idea, given their approach to semver versioning ranges 😛

Anyway, I managed to squish it out of the webmozart/glob library too (yes, I maintain that too 😅), so it can be done here too, without too much effort.

[machitgarha]

@Ocramius, I see. You actually saved more people than in this project. 😃

[Ocramius]

Hmm, I can't find (am on my phone) any usages of path-util in the codebase: perhaps my work on webmozart/glob already suffices to fix this, and a dependency bump is all we need?

Can you check if it can be safely removed? Because then we'd already be done.

See https://github.com/webmozarts/glob/releases/tag/4.5.0

[machitgarha]

@Ocramius, there are no usages of webmozart/path-util in the code base.

However, two packages still depend on it: infection/infection and vimeo/psalm. You can update Infection to 0.26, but vimeo/psalm still has it as a dependency with the latest stable. However, the good news is, they're going to remove it in 5.0.

[Ocramius]

That is alright, so the issue can be closed as solved, as it only affects dev-dependencies, and downstream consumers will not get the abandoned library installed.

[Manmathan5991]

am also facing the same issue guys... any instant solution to fix this issue. ?

[Manmathan5991]

11 package suggestions were added by new dependencies, use composer suggest to see details.
Package webmozart/path-util is abandoned, you should avoid using it. Use symfony/filesystem instead.
Generating autoload files
14 packages you are using are looking for funding.
Use the composer fund command to find out more!

[Ocramius]

@Manmathan5991 this package does not depend on that library anymore: please upgrade.