Allow egulias/email-validator v4

Actually this only brings a single change:

+-------------------------+-------+-------+
| Production Changes      | From  | To    |
+-------------------------+-------+-------+
| egulias/email-validator | 3.2.5 | 4.0.1 |
+-------------------------+-------+-------+

This is because:

$ composer why-not doctrine/lexer 3
doctrine/annotations 1.14.3 requires doctrine/lexer (^1 || ^2) 

The breaking change is dropping support for doctrine/lexer 1, so I think we are OK to do this now if we want to?

Will open another issue to discuss upgrading doctrine/annotations.

Adding a parent. I will note over there that this is still in discussion.

No failures.

Applied locally and ran composer update without issues.

This seems like a clear 11.0.0 target to me; what's the reason for attempting it in a minor?

Even if the library became unsupported, or another dependency required v4, or similar critical issues, we would default to opening the constraint to allow version 4, but still lock core to version 3 as long as possible.

I think we should contact the package author and ask them if they have an EOL date in mind for 3.x, given that if I remember correctly a previous branch was EOLed with little to no notice.

#3238763: Upgrade egulias/email-validator to v3 → was the previous issue - the EOL was pretty much immediate but the update was generally smooth. Agreed with asking the maintainer about EOL dates.

Whether we stay locked to v3 or v4, I think composer.json needs to allow downgrade/upgrade either way, so marking needs work for that.

Opened https://github.com/egulias/EmailValidator/issues/360

The v4 tests passed in #2 and the updated deps CI will let us know if this starts failing in the future for some reason, but this patch keeps us pinned to v3 while allowing sites to upgrade to v4.

Like the idea of #10

keeps us pinned to v3 while allowing sites to upgrade to v4.

From @egulias

Hi @catch56 , thanks for reaching out.
I'll keep the current support level for v3 (critical bug fixes) until the end of 2023.

https://github.com/egulias/EmailValidator/issues/360#issuecomment-150089...

So to not run an unsupported version, we need to update to v4 in 10.1 (allowing v3), that way 10.0.x goes out of support at the end of 2023 along with v3.

The other option would be allow v4 now, pin v4 in 10.2, and let the last six months of 10.1 be on the unsupported version (but with sites having the option to upgrade).

Will sites know they need to update this library to v4 manually though? Don't think we have a page that list out of date libraries.

Patch #10 appears to address #13 in allowing both v3 or v4

Let's go ahead here so that sites can update when they want to.

I've opened 📌 Pin to egulias/email-validator v4 Fixed to discuss whether we want to actually pin to v4 or not.

Automatically closed - issue fixed for 2 weeks with no activity.