[RFC] Help fade out "composer/package-versions-deprecated"

[nicolas-grekas]

Discussed with @Seldaek on Slack: it'd be great if we could help fade out this package by not requiring it in either symfony/* or doctrine/*. Instead, we should use the API provided by Composer 2.

Let's start from the most downloaded packages as listed here:
https://packagist.org/packages/composer/package-versions-deprecated/dependents?order_by=downloads&requires=require

[stof]

Given that Symfony 6 requires composer 2, we can use the native API in our own packages

[stof]

For doctrine pacjages, this should be discussed with the doctrine team though

[derrabus]

Doctrine DBAL 3.3 will require Composer 2 and drop the dependency: doctrine/dbal#5078

[stof]

OK, then I guess it is fine for other Doctrine projects to do the same kind of change

@nicolas-grekas I updated the packagist URL to list only packages having a require constraint. require-dev are much less impactful for the ecosystem

[stof]

Symfony packages are using it for 2 purposes:

• symfony/proxy-manager-bridge is requiring it, but without using it anymore since 4.4.17. So I opened a PR removing the dependency
• symfony/orm-pack requires it (and symfony/doctrine-bridge as a dev-requirement on it) due to the usage of ocramius/package-versions in older versions of the Doctrine packages. However, doctrine/orm 2.7.4+ is using composer/package-versions-deprecated directly instead of ocramius/package-versions, so I think we could drop our own requirement enforcing the replacer package. symfony/doctrine-bridge currently requires doctrine/orm 2.7.3+. Bumping the min version to 2.7.4 instead of 2.7.3 is OK for that (and once the ORM migrates to composer-runtime-api directly, the usage will be gone entirely).

[derrabus]

doctrine/orm#9356