Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:104006
MIME-Version: 1.0
References: <CAF+90c-B=xU9phGNxcRvZE+2c1RkKvsiDXU0qzWJdU_U3Tskag@mail.gmail.com>
 <7a909cd3-5d0f-8f2e-fba8-009778311bf0@php.net> <CAOwTYAspymG1HVBWSNGeuSK+gHcnBoxG599wqyD2-NDbOPeCfg@mail.gmail.com>
 <CAAfnsFUiV25V=BO3+iU63FM3U0jKbnL5AOTL0=+x1tt6v3Agow@mail.gmail.com> <db1bacc7-e64d-e2bf-5c41-81521359e29a@librelamp.com>
In-Reply-To: <db1bacc7-e64d-e2bf-5c41-81521359e29a@librelamp.com>
Date: Sat, 2 Feb 2019 02:12:26 +0100
Message-ID: <CAAfnsFX2JTUPX8ishkc0-=R0fbs_KSAQou3Da9Sb7Jtoz-c5Xg@mail.gmail.com>
To: Alice Wonder <alice@librelamp.com>
Cc: Internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] Disable PEAR by default
From: peterkokot@gmail.com (Peter Kokot)

Hello,

On Sat, 2 Feb 2019 at 02:08, Alice Wonder <alice@librelamp.com> wrote:
> I do not like composer. A problem I have encountered, a project
> specifies a version for a dependency.
>
> That version has vulnerability, developer fixed it in newer release, but
> composer keeps pulling in the older version because that is what
> composer provides.
>
> And it can be the dependency of a dependency of a dependency.
>
> I do not like Composer.
>
> Adding a "recognition page" while cutting PEAR off also seems, well, slimy.

Frankly, this is irrelevant. If you don't use Composer, that's your
choice. PEAR isn't maintained and will cause similar issues all the
time. Not removing this installation option from php-src in the near
future means maintaining patches for all that time this option will be
present in the PHP and shipping separate pear package for all Linux
distributions. I don't like the sound of that.


-- 
Peter Kokot