Problem/Motivation
It is not clear why we have a reference to ircmaxell/password-compat in our composer.lock file. I suppose it was required at one point and since we update everything one at a time, this got left in there. There is no reference or dependency to this package anywhere except one lone entry in composer.lock.
~/w/d/drupal 8.8.x *… > composer why ircmaxell/password-compat There is no installed package depending on "ircmaxell/password-compat"
This was found while working on #3079791: Bump Drupal's minimum PHP version to 7.2 as soon as 9.0.x is branched (a higher version may be required later). See comment 26 in that issue.
Proposed resolution
Remove the reference to the package. Running composer update removes it automatically but that doesn't help us. composer remove ircmaxell/password-compat reports a warning but removes the package.
Remaining tasks
- Decide if this is not required and if it is the correct approach.
User interface changes
None
API changes
The forward compatibility layer won't be available anymore but that doesn't matter because these functions exist in PHP since 5.5.
Data model changes
None
Release notes snippet
The package ircmaxell/password-compat was removed from the composer.lock file as it is no longer needed.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | 3085456-3.patch | 2.88 KB | hussainweb |
Comments
Comment #2
hussainwebComment #3
hussainwebHere is a patch after running the composer remove command as per IS.
Comment #4
catchDid some archaeology, for whatever reason this was added by #1475510: Remove external dependencies from the core repo and let Composer manage the dependencies instead.
The issue to actually use password_hash() is still open in #1845004: Replace custom password hashing library with PHP password_hash().
Comment #5
xjmReparenting to the sub-meta about removing things. Thanks @hussainweb!
Comment #6
xjmI added a test run against 8.8.x just to test the patch and ensure it's geen.
Comment #7
wim leersWonderful catch, @hussainweb! 👏
Comment #9
catchNeeds a re-roll against 9.0.x
Comment #10
hussainwebI don't see the package anymore in composer.lock on 9.0.x. I think this has been removed by some of the other issues which might have run updates. I think this can be closed.
Comment #11
catchAh thanks, closing!