allure-framework / allure-framework/allure-phpunit

Remove abandoned `doctrine/annotations` dependency in next major release

Open
#121 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
66
Forks
34
PR merge metrics
No merged PRs in 30d

Description

# Problem

The package currently requires `doctrine/annotations`, which has been [officially abandoned](https://github.com/doctrine/annotations/issues/485) and marked as such on Packagist.

This creates issues for downstream projects that need to run security audits on production dependencies:

## This fails due to doctrine/annotations being abandoned
```bash
composer audit --locked
```

## Workaround: exclude dev dependencies
```bash
composer audit --locked --no-dev
```

The workaround is not ideal as it prevents security auditing of dev dependencies.

Current Dependency Chain

```
allure-framework/allure-phpunit v3.1.0
└─ allure-framework/allure-php-commons v2.3.1
└─ doctrine/annotations (^1.12 || ^2) ⚠️ ABANDONED
```

# Proposed Solution

Since this package targets PHP 8.1+, native PHP attributes should be used instead of Doctrine annotations. PHP 8 attributes provide all the functionality of annotations with native language support.

For next major release:
- Remove `doctrine/annotations` dependency entirely
- Migrate any remaining annotation-based code to PHP 8 attributes
- This would be a breaking change suitable for a major version bump

Additional Context

- The `doctrine/annotations` package was deprecated in favor of native PHP 8 attributes
- PHP attributes are now the recommended approach for metadata
- This package already requires PHP 8.1+, so attributes are fully supported
- Packagist link showing abandoned status: https://packagist.org/packages/doctrine/annotations

Impact

This affects any project using allure-framework/allure-phpunit in dev dependencies that wants to:
- Run security audits with composer audit
- Maintain clean dependency trees without abandoned packages
- Follow PHP ecosystem best practices

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.