DEV Community

Discussion on: Managing Outdated Composer Dependencies

Collapse
 
accreditly profile image
Accreditly

One thing not commented on too much here is having the dependency on... well, dependencies, and how destructive that can be if they disappear. I'm not talking about them no longer being maintained, but disappearing all together.

A few years ago we built an app that relied fairly heavily on a library for generating barcodes. The barcode support we needed was a little niche, so the options for libraries was fairly limited. Anyway, we built the app, with a dependency on this library and all was well with the world.

The project lay dormant for a period of time and didn't actually go live at any point. A while in the future we needed to add a couple of features and then go ahead an launch. We hit an issue when cloning the repo and running composer install... 404 Not Found on a repo URL. The owner of the repository hadn't just abandoned it, but they also deleted it. Everything, gone.

This was an app in development, so it wasn't like we could just go and grab the folder from the vendor folder in production. It was gone. And we had a heavy dependency on it.

Lesson learnt: Anything you rely on heavily, ensure you fork it and keep a copy yourself in a private repo, just in case (licence permitting, of course).

Fortunately we managed to get a copy of the library in question from an old dev machine we had, so not all bad :)