Switch from webmozart/path-util to new package symfony/filesystem

Think this will do it.

Patch on #2 works for me.

Do you have any idea when this modification will be validated and packaged in a new version of the module?

For people who have automated tests in a CI, for example with composer audit, the webmozart//path-util package appears as abandoned and so CIs often fail.

Two positive reviews.

Any chance of this and https://www.drupal.org/i/3485647 → getting merged some time soon?

Because yes, drush language:* is mostly a replacement for this module, but there is some convenience stuff in here that would be cool to keep!

RTBC and please merge an release version.

When applying the patch into the composer.json will it still show the issue on composer audit?

I set the patch in composer.json and ran composer install, but the audit still shows the error.

@watkinsj Unable to verify this right now, but AFAIK composer audit scans your composer.lock file for packages with known vulnerabilities and packages that depend on ones with known vulnerabilities.

Maybe take a look at your drush_language entry in the lock file and its dependencies. Or maybe audit knows that drush_language has inherited an issues from its dependency?

Patching composer.json does nothing because Composer reads the dependencies from the remote repository (when adding or updating a dependency) or from your composer.lock file (on subsequent installs), not from the patched composer.json file.