webmozart/path-util is abandoned

[danepowell]

Describe the bug
Installing Drush via Composer produces a warning:

Package webmozart/path-util is abandoned, you should avoid using it. Use symfony/filesystem instead.

I know this is just a warning and end users can ignore it for now, but it's still a risk (bad things happen to abandoned packages) and the package needs to be removed/replaced.

To Reproduce
composer require drush/drush

Expected behavior
No warnings

Actual behavior

Package webmozart/path-util is abandoned, you should avoid using it. Use symfony/filesystem instead.

Workaround
Ignore the warning

System Configuration

Q	A
Drush version?	11.x

[weitzman]

Oy. We use that everywhere!

[greg-1-anderson]

Sad panda. It's a small library; I guess we could just copy it into Drush, or maybe fork it into Consolidation and adopt ownership.

We could review symfony/filesystem and see if it really does contain all of the methods in path-util; last time I checked, it didn't, but that was a while ago.

[romulasry]

Sad panda. It's a small library; I guess we could just copy it into Drush, or maybe fork it into Consolidation and adopt ownership.

We could review symfony/filesystem and see if it really does contain all of the methods in path-util; last time I checked, it didn't, but that was a while ago.

Any way to contact them?

[romulasry]

I found this at their support page https://symfony.com/support

https://github.com/symfony/symfony/discussions

I posted there:
"Does symfony/filesystem contain all of the methods in webmozart/path-util?"

symfony/symfony#44740

[danepowell]

We faced this problem in typhonius/acquia-php-sdk-v2#219 and found it easy enough to migrate to symfony/filesystem, all of the functions were the same. The only problem is that it breaks compatibility with Symfony 4.

Incompatibility with Symfony 4 is the biggest problem here and looks like it would affect Drush as well. I think Symfony should backport this to Symfony 4 since it's supposed to be supported for a few years yet.

[danepowell]

I opened an upstream feature request with Symfony to backport Path functionality to Symfony 4: symfony/symfony#44897

[weitzman]

Thanks @danepowell

[konfuzed]

FYI from Symfony's point of view, the legacy code should be copied back into projects that need it since they will not add it as a new feature back into v4--and they closed the above ticket on it symfony/symfony#44897 (comment)

[weitzman]

Sounds like we keep depending on the abandoned package until someone submits a PR to change our calls.

[danepowell]

Copying the code into individual projects is half of a solution: it at least gets rid of the end-user warning, and mitigates the risk of something bad or malicious happening to the abandoned package. It doesn't help much with maintenance though.

I might fork path-util with the sole purpose of porting future changes (if any) from Symfony. Then projects like Drush can rely on the half-maintained fork. Ideally Symfony would maintain this themselves, but judging by the tepid reaction to symfony/symfony#44897, that seems unlikely.

[weitzman]

Fixed in #5264