Package sebastian/resource-operations is abandoned, you should avoid using it.

[anegve]

Q	A
PHPUnit version	9.5.10
PHP version	7.4.3
Installation Method	Composer

Summary

In #4806 sebastian/resource-operations got un-abandoned and then abandoned again. Can sebastian/resource-operations be made un-abandoned once more or changed on different package?

[sebastianbergmann]

@Seldaek I keep un-abandoning this package and somehow Packagist seems to automatically abandon it. Is this because the repository is archived on GitHub?

[Seldaek]

Yes if it's archived we automatically abandon. Is there a good reason not to?

[sebastianbergmann]

Thank you for the explanation, Jordi.

I have no intention to ever work on https://github.com/sebastianbergmann/resource-operations again. Because of this, I have archived the repository. But there are versions of PHPUnit that are still supported that depend on this component. Apparently telling people to simply ignore the warning from Composer that an abandoned dependency is used is not an option.

I do not know what the right course of action is, but for now I will unarchive the repository so that the package will not get automatically abandoned on Packagist.

[Seldaek]

Ah perhaps you can set "abandoned": false in the composer.json of the default branch, and then archive it again, I'm thinking that should work to avoid the automatic behavior

[davereid]

FYI this was marked as archived again on March 13 2024 without the addition of abandoned: false so anything using PHPUnit 9 is getting marked as security failures again.

[sebastianbergmann]

PHPUnit 9 no longer receives bug fixes and a new release of PHPUnit 9 will only be made if a change in a new version PHP requires adaptation.

[sebastianbergmann]

I unarchived the repository, added abandoned: false to composer.json, tagged a new release, and archived the repository again.

As of right now, https://packagist.org/packages/sebastian/resource-operations shows the package as "not abandoned".

Hope that helps.

[davereid]

@sebastianbergmann Yes, thank you! Understood about PHPUnit 9 not getting any more fixes. The changes and updated release of resource-operations helps address the issue for the whole Drupal community since we currently depend on PHPUnit 9, although I'm sure there is an effort to update to the latest version.