Add PHP 8.3 support. Mark package abandoned.

[Xerkus]

Q	A
Documentation	no
Bugfix	no
BC Break	no
New Feature	no
RFC	no
QA	yes

Description

This package was introduced to simplify migration from Zend Framework packages to Laminas. In a month it will be 4 years since Zend Framework migrated to Laminas. None of Zend Framework packages support php 8 and none of supported Laminas packages support php <8.

If users still depend on this package they are strongly urged to complete migration and remove this dependency.

[froschdesign]

@Xerkus
We have made a mistake here, because the component should be marked as security-only and not abandoned. See:

laminas-zendframework-bridge/composer.json

Line 17 in eb0d96c

"abandoned": true,

• https://github.com/laminas/technical-steering-committee/blob/main/meetings/minutes/2022-07-11-TSC-Minutes.md#future-of-the-migration-layer
• https://github.com/laminas/laminas-zendframework-bridge?tab=readme-ov-file#laminas-zendframework-bridge
• https://github.com/laminas/laminas-zendframework-bridge/custom-properties

With the API tools, this is now a problem for ourselves.

[Xerkus]

composer's abandoned flag is not the same as not receiving security patches.

[froschdesign]

But we do not use the "abandoned" flag in the Composer configuration for security-only packages, only if they are archived: https://github.com/laminas/laminas-crypt
At least that has been the procedure so far.

[Xerkus]

It is not really limited to archived repos. In this case we discussed in the slack if bridge should receive new php version support and if we should mark it abandoned to encourage people to stop relying on it if they still do. General consensus was what we have here.

Abandoned flag in composer is merely informational. It is getting noticed so it works as intended.

If someone does not need the bridge but it is a transient dependency then same approach can be taken as we used in the first years after migration to Laminas. Add replace to the root composer.json of the application:

    "replace": {
        "laminas/laminas-zendframework-bridge": "*"
    },

Bigger issue here is that api-tools are not marked as abandoned but entirely discontinued.

[froschdesign]

I think the whole thing needs to be better documented, otherwise the question will keep coming up.

Bigger issue here is that api-tools are not marked as abandoned but entirely discontinued.

That is true.

[Xerkus]

May be add it to the README since there is no web documentation.

[froschdesign]

I think we should automate the creation of the readme file. The relevant data are already available in the Composer configuration file and in the repository (custom properties).