Problem/Motivation

It is not clear why we have a reference to ircmaxell/password-compat in our composer.lock file. I suppose it was required at one point and since we update everything one at a time, this got left in there. There is no reference or dependency to this package anywhere except one lone entry in composer.lock.

~/w/d/drupal   8.8.x *… > composer why ircmaxell/password-compat There is no installed package depending on "ircmaxell/password-compat"

This was found while working on #3079791: Bump Drupal's minimum PHP version to 7.2 as soon as 9.0.x is branched (a higher version may be required later). See comment 26 in that issue.

Proposed resolution

Remove the reference to the package. Running composer update removes it automatically but that doesn't help us. composer remove ircmaxell/password-compat reports a warning but removes the package.

Remaining tasks

- Decide if this is not required and if it is the correct approach.

User interface changes

None

API changes

The forward compatibility layer won't be available anymore but that doesn't matter because these functions exist in PHP since 5.5.

Data model changes

None

Release notes snippet

The package ircmaxell/password-compat was removed from the composer.lock file as it is no longer needed.

CommentFileSizeAuthor
#3 3085456-3.patch2.88 KBhussainweb

Comments

hussainweb created an issue. See original summary.

hussainweb’s picture

Status: Active » Needs review
StatusFileSize
new2.88 KB

Here is a patch after running the composer remove command as per IS.

catch’s picture

Did some archaeology, for whatever reason this was added by #1475510: Remove external dependencies from the core repo and let Composer manage the dependencies instead.

The issue to actually use password_hash() is still open in #1845004: Replace custom password hashing library with PHP password_hash().

xjm’s picture

Reparenting to the sub-meta about removing things. Thanks @hussainweb!

xjm’s picture

I added a test run against 8.8.x just to test the patch and ensure it's geen.

wim leers’s picture

Status: Needs review » Reviewed & tested by the community

Wonderful catch, @hussainweb! 👏

Version: 9.x-dev » 9.0.x-dev

The 9.0.x branch will open for development soon, and the placeholder 9.x branch should no longer be used. Only issues that require a new major version should be filed against 9.0.x (for example, removing deprecated code or updating dependency major versions). New developments and disruptive changes that are allowed in a minor version should be filed against 8.9.x, and significant new features will be moved to 9.1.x at committer discretion. For more information see the Allowed changes during the Drupal 8 and 9 release cycles and the Drupal 9.0.0 release plan.

catch’s picture

Status: Reviewed & tested by the community » Needs work
Issue tags: +needs re-roll

Needs a re-roll against 9.0.x

hussainweb’s picture

I don't see the package anymore in composer.lock on 9.0.x. I think this has been removed by some of the other issues which might have run updates. I think this can be closed.

catch’s picture

Status: Needs work » Closed (outdated)

Ah thanks, closing!