Source
r/PHP•
pfsalter

Hautelook's AliceBundle has disappeared :O

So the AliceBundle which currently has 100k downloads a week on packagist has just disappeared for some reason. I'm working on trying to get a cached or forked version of it available so people can continue to use it. If anyone knows of a recent cloneable version please let us know!

More information here: https://stackoverflow.com/questions/69126582/hautelook-alicebundle-is-gone-whats-going-on And here: https://github.com/nelmio/alice/issues/1089

Looks like you can add this to your composer.json to fix this temporarily until this is all resolved:

"repositories": [
    {
        "type": "vcs",
        "url": "https://github.com/theofidry/AliceBundle"
    }
],

This is supplied by Theo Fidry, who is the maintainer of AliceBundle.

Posted Sep 10, 2021, 1:02 PM UTC · edited

2512
2019-01-03•

So I run the Bettergist Collective which usually archives every single PHP package at least 2x a year. I didn't archive in 2021 because I'm working so much and there never seems to be much [psychological] support in the PHP community, but I do have a backup of this package from May 2020.

I have created a packagist package and everything. Latest version archived: v2.7.2.

https://github.com/bettergistco/hautelook.alice-bundle https://packagist.org/packages/bettergist/hautelook-alice-bundle

composer require bettergist/hautelook-alice-bundle

The entire 100 GB torrent of all PHP packagist packages as of December 2020 is floating around there somewhere, but r/PHP has never accepted me, so I don't think I published it here.

5
funkywhat•

Some information from theofidry and a temporary solution > https://github.com/nelmio/alice/issues/1089

3
cerad2•

There was another similar case in which the symfony/webpack-encore-pack package went poof and needed to be replaced with an incompatible symfony/webpack-encore-bundle package.

These are actually good wakeup calls. I had been under the impression that packages did not just disappear. At least not those with a reasonable number of downloads. I figured a composer.lock file as well as keeping a particular PHP version available was all that was needed to reproduce the vendor directory. Wrong thinking on my part.

2
pfsalterOP•

If you're working at a large enough corporation you can use Private Packagist (paid) to cache remote repositories. This should stop this from happening to you in future. I also forgot that public Packagist doesn't actually host the packages themselves, which is how this happened in the first place.

1
m50•

Same with many of their packages.

We were using one that disappeared today as well.

1
krileon•

This is why I commit my dependencies instead of just expecting them to still exist at build time. Sure it makes my repos a bit bigger, but who cares.. storage is cheap.

1
goodwill764•

How do you work with dev dependcies and production server?

1
krileon•

All dependencies are committed to git. They are not a part of the build pipeline. It ships with the dependencies included. This makes GIT larger and the package larger, but that doesn't really matter as it's still an insignificant amount of MBs. The benefit is my dependencies always exist and I can review their code every time I update them. So for example I'll update them locally with composer, commit to a dep-up branch, create merge request and have it go through full review process. The benefit of that is no one is sneaking bullshit into my projects. Additionally because I am using composer if at any point I want to stop doing this or if someone needs it without the dependencies included that's easily doable.

2
Zekro•

You do know that including development dependencies, like PHPUnit, in a production release might be a security risk?

2
krileon•

Developer dependencies aren't included in production releases. Sorry, should've said that in my original reply.

2
KraZhtest•

Lol.

Write your libraries, guys, for a lifetime.

-6
KraZhtest•

Or die, LOL

-1