Review third-party PHP 8.4 deprecations before 6.0.0-rc1

[emteknetnz]

Background #331 (comment)

Review the deprecation warnings in CI before we release 6.0.0-rc1 in case we need to do some forking or replace a dependency, or at the very least so that we can provide appropriate comms to indicate that while our codebase has been updated, some upstream dependencies are known to not have done so yet.

Notes

• onelogin/php-saml just needs release
• sensiolabs/ansi-to-html just needs release has been released
• Some PRs below are for webauthn-authenticator which is no longer supported though is a dev-dependency in sink

PRs for thirdparty repos

• Make nullable parameter explicity nullable for PHP 8.4 aws/aws-sdk-php#3043
• Make nullable parameters explicity nullable for PHP 8.4 php-embed/Embed#551
• Make nullable parameters explicity nullable for PHP 8.4 lanthaler/JsonLD#112
• Make nullable parameters explicity nullable for PHP 8.4 reactphp/child-process#111
• Make nullable parameters explicity nullable for PHP 8.4 Spomky-Labs/pki-framework#59
• Make nullable parameters explicity nullable for PHP 8.4 ua-parser/uap-php#79
• Make nullable parameters explicity nullable for PHP 8.4 web-auth/webauthn-framework#662

Acceptance criteria

• Make sure to update composer constraints as required to get new versions
• Investigate any that have not been merged and work out what to do with it

PRs

• DEP Replace ua-parser/uap-php with donatj/phpuseragentparser silverstripe-session-manager#245

[GuySartorelli]

We don't need to updated the minimum constraint for any of these as the prefer-lowest builds are for PHP 8.3 - so as long as the updated release matches our ^x.y constraint we're fine.

None of the released updates resulted in new major tags.

Unmerged PRs

• Make nullable parameters explicity nullable for PHP 8.4 ua-parser/uap-php#79
  • This package appears to have been abandoned. It hasn't had any new commits for 5 years. It is only used by silverstripe/session-manager to convert the user agent into something human readable which is a very low-risk use case. I will replace it with an alternative dependency which is better maintained.
• Make nullable parameters explicity nullable for PHP 8.4 lanthaler/JsonLD#112
  • This package may have been abandoned as well. It hasn't had any new commits for 3 years. It's a dependency of embed/embed so we can't directly replace it, and replacing embed/embed itself would be risky at this stage. I've opened Swap out ml/json-ld dependency with one that is maintained (required for PHP 8.4) php-embed/Embed#554 but note that embed/embed itself is looking for a new maintainer, so this may not be actioned. When it comes time to update for PHP 8.5 we may be forced to take one action or another - for now we may be able to ignore it.

Unreleased updates

• onelogin/php-saml
  • This is a dependency of silverstripe/realme. It does a lot of the heavy lifting so I'd prefer to not replace it if we can avoid it. I've added a comment to the PR asking if there will be a tag any time soon. We can possibly ignore this for now (deprecation warnings are fine in production and its usage in development environments is likely very small) - but we may have to do something when PHP 8.5 rolls around.

[emteknetnz]

Assigning back to Guy to confirm you're not planning on doing anything else here. If that's correct then just close issue.

[GuySartorelli]

Correct, nothing more to do here.