0020 - BC Break & PHP Abandoned Dependency

[Progi1984]

Questions	Answers
Description?	New ADR
Type?	improvement

[Progi1984]

Ping @PrestaShop/committers & @PrestaShop/prestashop-core-developers

[eternoendless]

IMO this should be allowed if and only if these are true:

1. The package is not a direct dependency (meaning that it's not in our composer.json)
2. It's not a popular dependency (eg. symfony subcomponents)
3. There's a known, important security vulnerability that cannot be patched easily in a temporary fork
4. (if applicable) an alternative package exists

[eternoendless]

BTW it's easier to discuss the subject on an issue, then create the decision record

[Progi1984]

@eternoendless So what can we do when direct dependency (it's the target of the ADR) is abandonned during a minor version ?

I will give a example : SwiftMailer is not maintained since Nov 2021

BTW it's easier to discuss the subject on an issue, then create the decision record

I follow the process in the README.md

[eternoendless]

what can we do when direct dependency (it's the target of the ADR) is abandonned during a minor version ?

Unfortunately we need to keep it until the next major, unless an important security vulnerability is found and it cannot be patched in a fork.

[Progi1984]

@eternoendless Thanks for your feedback. I understand it. I will close this ADR.