Coding standards and PHPStan tests note that libxml_disable_entity_loader() is deprecated, but it is needed for Drupal 9 support:
// Only available in PHP >= 5.2.11 and < PHP 9.0. Since PHP 8.0 it is
// deprecated. This mitigates a security issue in libxml older than version
// 2.9.0.
// See http://symfony.com/blog/security-release-symfony-2-0-17-released for
// details.
// @todo remove when Drupal 9 (and thus PHP 7) is no longer supported.
if (function_exists('libxml_disable_entity_loader') && \PHP_VERSION_ID < 80000) {
$this->entityLoader = libxml_disable_entity_loader(TRUE);
}
Remove this code when Drupal 11 is released (Drupal 9 support ends).
Postponed
1.0
Code