1

I am upgrading my symfony tot 6.4. Since 6.3 I have seen this warning while updating packages in Symfony:

"Package laminas/laminas-zendframework-bridge is abandoned, you should avoid using it. No replacement was suggested.".

I have tried to see what depends on it using:

composer depends laminas/laminas-zendframework-bridge

Which results in:

__root__ dev-master requires laminas/laminas-zendframework-bridge (^1.6)

I don't know what this means. Does it mean that when laminas is removed "root" and "dev-master" won't work? I don't understand it.

Is it safe to remove this package?

Composer.json:

{ "type": "project", "license": "proprietary", "require": { "php": ">=8.2.12", "ext-ctype": "*", "ext-iconv": "*", "composer/package-versions-deprecated": "1.11.99.1", "doctrine/annotations": "^1.0", "doctrine/doctrine-bundle": "^2.3", "doctrine/doctrine-migrations-bundle": "^3.1", "doctrine/orm": "^2.8", "laminas/laminas-zendframework-bridge": "^1.6", "phpdocumentor/reflection-docblock": "^5.2", "symfony/asset": "6.4.*", "symfony/console": "6.4.*", "symfony/dotenv": "6.4.*", "symfony/expression-language": "6.4.*", "symfony/flex": "^1.3.1", "symfony/form": "6.4.*", "symfony/framework-bundle": "6.4.*", "symfony/http-client": "6.4.*", "symfony/intl": "6.4.*", "symfony/mailer": "6.4.*", "symfony/monolog-bundle": "^3.7", "symfony/password-hasher": "6.4.*", "symfony/process": "6.4.*", "symfony/property-access": "6.4.*", "symfony/property-info": "6.4.*", "symfony/proxy-manager-bridge": "6.4.*", "symfony/runtime": "6.4.*", "symfony/security-bundle": "6.4.*", "symfony/translation": "6.4.*", "symfony/twig-bundle": "^6.4", "symfony/validator": "6.4.*", "symfony/web-link": "6.4.*", "symfony/webpack-encore-bundle": "^1.11", "symfony/yaml": "6.4.*", "symfonycasts/reset-password-bundle": "^1.7", "symfonycasts/verify-email-bundle": "^1.4", "twig/extra-bundle": "^2.12|^3.0", "twig/twig": "^2.12|^3.0" }, "require-dev": { "doctrine/doctrine-fixtures-bundle": "^3.4", "rector/rector": "^1.2", "symfony/browser-kit": "^6.4", "symfony/css-selector": "^6.4", "symfony/debug-bundle": "^6.4", "symfony/maker-bundle": "^1.30", "symfony/phpunit-bridge": "^6.4", "symfony/stopwatch": "^6.4", "symfony/var-dumper": "^6.4", "symfony/web-profiler-bundle": "^6.4" }, "config": { "preferred-install": { "*": "dist" }, "sort-packages": true, "allow-plugins": { "symfony/flex": true, "symfony/runtime": true } }, "autoload": { "psr-4": { "App\\": "src/" } }, "autoload-dev": { "psr-4": { "App\\Tests\\": "tests/" } }, "replace": { "paragonie/random_compat": "2.*", "symfony/polyfill-ctype": "*", "symfony/polyfill-iconv": "*", "symfony/polyfill-php71": "*", "symfony/polyfill-php70": "*", "symfony/polyfill-php56": "*" }, "scripts": { "auto-scripts": { "cache:clear": "symfony-cmd", "assets:install %PUBLIC_DIR%": "symfony-cmd" }, "post-install-cmd": [ "@auto-scripts" ], "post-update-cmd": [ "@auto-scripts" ] }, "conflict": { "symfony/symfony": "*" }, "extra": { "symfony": { "allow-contrib": false, "require": "6.4.*" } } }
Improve this question
2
  • 1
    No other dependency declares that requires it. Maybe some other of your code does? Luckily you have tests, so you can remove this and check if the tests still pass. Commented Sep 4, 2024 at 8:43
  • Do you use git (or any other version control)? Then you would be able to check why your own application requires that package to be installed - any commit that introduced this requirement should contain more details Commented Sep 4, 2024 at 18:28

1 Answer 1

Reset to default
4

Nothing in Symfony intrinsically depends on laminas/laminas-zendframework-bridge. If you had it installed, it was because some other dependency required it (or you thought it required it).

This

$ composer depends laminas/laminas-zendframework-bridge __root__ dev-master requires laminas/laminas-zendframework-bridge (^1.6)

Only means that the dependency exists at "root level". Meaning, it is declared in your own composer.json explicitly, in the require section.

The message is telling you: "this is a direct dependency, declared by you; no other dependency in your project declares a dependency on this package".

So with that information, you should be able to remove the package.

But of course, you should make sure that your own code is not using the package first. Since you do not seem to depend on anything else related to Laminas, you should be safe. But use common-sense and test your code.

Improve this answer
Sign up to request clarification or add additional context in comments.

3 Comments

Feel kind of stupid now haha. I just needed to know this, tnx!
Don't fret. It happens to us all.
Generally speaking, when you remove package from your project's composer.json composer won't remove it if the package is still needed by some other dependency. Only thing you need to worry about is where the package is used in your project's code.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.