Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:104007
To: internals@lists.php.net
References: <CAF+90c-B=xU9phGNxcRvZE+2c1RkKvsiDXU0qzWJdU_U3Tskag@mail.gmail.com>
 <7a909cd3-5d0f-8f2e-fba8-009778311bf0@php.net>
 <CAOwTYAspymG1HVBWSNGeuSK+gHcnBoxG599wqyD2-NDbOPeCfg@mail.gmail.com>
 <CAAfnsFUiV25V=BO3+iU63FM3U0jKbnL5AOTL0=+x1tt6v3Agow@mail.gmail.com>
 <db1bacc7-e64d-e2bf-5c41-81521359e29a@librelamp.com>
Message-ID: <ede99a40-3cd9-9006-21cb-f0abbf9e23fc@librelamp.com>
Date: Fri, 1 Feb 2019 17:12:44 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <db1bacc7-e64d-e2bf-5c41-81521359e29a@librelamp.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Disable PEAR by default
From: alice@librelamp.com (Alice Wonder)

On 2/1/19 5:08 PM, Alice Wonder wrote:
> On 2/1/19 3:06 PM, Peter Kokot wrote:
>> Hello,
>>
>> On Fri, 1 Feb 2019 at 12:44, Joe Watkins <krakjoe@gmail.com> wrote:
>>>
>>> +1
>>>
>>> On Fri, 1 Feb 2019 at 12:35, Sebastian Bergmann <sebastian@php.net> 
>>> wrote:
>>>
>>>> Am 01.02.2019 um 12:27 schrieb Nikita Popov:
>>>>> I would like to suggest that installation of PEAR is disabled by 
>>>>> default
>>>> in
>>>>> PHP 7.4. PR: https://github.com/php/php-src/pull/3781
>>>>
>>>> +1
>>
>> Thank you Nikita for the pull request for this. With all the respect
>> to PEAR project and people behind it, maybe the PEAR itself should be
>> added to some sort of recognition page in the manual for their
>> involvement and work on the first installer of PHP code and initial
>> move into code reuse, open source PHP libraries, and all that. As time
>> went forward, Composer took over the role of such installer in PHP
>> community.
> 
> I do not like composer. A problem I have encountered, a project 
> specifies a version for a dependency.
> 
> That version has vulnerability, developer fixed it in newer release, but 
> composer keeps pulling in the older version because that is what 
> composer provides.
> 
> And it can be the dependency of a dependency of a dependency.
> 
> I do not like Composer.
> 
> Adding a "recognition page" while cutting PEAR off also seems, well, slimy.
> 

"because that is what composer provides." should be "because that is 
what composer specifies."