Package Versions Deprecated Laravel Package

Technical Evaluation

Architecture fit: This package is a legacy shim for Composer version resolution, designed as a temporary bridge for Composer 1→2 migration on PHP <7.4. It has no place in modern architectures since Composer 2.2+ natively provides Composer\InstalledVersions functionality. Its runtime file generation (via Versions.php) adds unnecessary complexity and conflicts with modern Composer optimizations like --classmap-authoritative.

Integration feasibility: Technically feasible for legacy projects stuck on PHP 7.0-7.3 with Composer 2 dependencies, but strongly discouraged for new integrations. The package requires special Composer flags (--optimize-autoloader) to avoid performance issues and has known conflicts with --no-scripts and global installations. Modern projects should use native Composer APIs instead.

Technical risk: High. The package is officially deprecated with no security updates. Key risks include:

• Conflicts with Composer 2.2+ native features (e.g., Composer\InstalledVersions collisions)
• Unresolved edge cases in --no-dev installs and PHAR contexts
• Potential file permission issues during removal (per issue #41)
• Deprecated code triggering E_USER_DEPRECATED warnings that break strict error handling

Key questions:

1. Why is this package still present? (Check if it's transitively required by outdated dependencies like Symfony <5.4 or Doctrine <2.10)
2. What is the plan to remove it? (All usage must be replaced with Composer\InstalledVersions before Composer 2.3+)
3. Is the project on PHP ≥7.4 and Composer ≥2.2? If yes, immediate removal is mandatory.
4. How are version checks currently implemented? (All PackageVersions\Versions::getVersion() calls must be migrated)

Integration Approach

Stack fit: Only suitable for temporary use in legacy PHP 7.0-7.3 projects where Composer 2 is required but PHP upgrade isn't possible. Never use in PHP 7.4+ or Composer 2.2+ environments. Modern stacks (Symfony 5.4+, Laravel 9+, Composer 2.2+) should never install this package.

Migration path:

1. Audit code for PackageVersions\Versions usage (e.g., grep -r 'PackageVersions\\Versions' .)
2. Replace all calls with Composer\InstalledVersions::getVersion('package/name')
3. Verify Composer version ≥2.2 (composer --version)
4. Remove composer/package-versions-deprecated from composer.json
5. Run composer update --with-all-dependencies to clean up dependencies
6. Execute composer dump-autoload --optimize to regenerate autoloaders

Compatibility:

• Incompatible with Composer 2.2+ for new development (native APIs supersede it)
• Conflicts with composer/package-versions v1.* during upgrades
• Fails in HHVM (per changelog 1.1.1) and with --no-dev without workarounds
• Only compatible with PHP 7.0-8.x (but should be removed entirely from all versions)

Sequencing:

1. Before integration: Confirm Composer ≥2.2 and PHP ≥7.4 in target environment
2. If legacy system:
   • Migrate all code to Composer\InstalledVersions