Phpdocumentor: Abandoned package "herrera-io/phar-update" leads to warnings

[Christoph-Harms]

Looks like the abovementioned package has recently changed it's status to "abandoned" (together with some other sub-dependencies). When phpdocumentor is included in a project as composer dependency, this leads to the following warnings on composer update:

Package kherge/version is abandoned, you should avoid using it. No replacement was suggested.
Package herrera-io/json is abandoned, you should avoid using it. Use kherge/json instead.
Package herrera-io/phar-update is abandoned, you should avoid using it. No replacement was suggested.

The mentioned packages should be replaced.

[demiankatz]

There is some discussion of this issue at https://github.com/hechoendrupal/drupal-console/issues/806 which might be helpful (there is an alternative package suggestion there).

[tolidano]

Ok, this should really be addressed sooner rather than later.

From the other drupal issue:
"I did see an alternatice phar-update package that seems to be maintained (at least it's had activity since 2013) https://github.com/padraic/phar-updater but it looks different in approach from the herreira project."

The file that uses this updater is here: src/phpDocumentor/Command/Phar/UpdateCommand.php:14

Also note that phpdocumentor is using 1.0.3:
composer.json:31: "herrera-io/phar-update": "1.0.3",
But there is a 2.0.0 version (also abandoned).

This 2.0.0 version switches the dependency from kherge/version (ALSO abandoned) to herrera-version (ALSO abandoned).

It also switches the dependency for herrera-io/json from 1.0.3 to 2.0.0. The 1.0.3 version lists NO replacement, but the 2.0.0 version suggests replacing with kherge/json, which appears to be a fairly reasonable replacement.

So this issue is really to switch the UpdateCommand to padraic/phar-updater, which would eliminate all these abandoned warnings. The explanation for how to alter the command is here:
https://github.com/padraic/phar-updater/tree/master