Is it safe to remove composer package: "laminas/laminas-zendframework-bridge" in symfony 6.4?

Question

I am upgrading my symfony tot 6.4. Since 6.3 I have seen this warning while updating packages in Symfony:

"Package laminas/laminas-zendframework-bridge is abandoned, you should avoid using it. No replacement was suggested.".

I have tried to see what depends on it using:

composer depends laminas/laminas-zendframework-bridge

Which results in:

__root__  dev-master  requires  laminas/laminas-zendframework-bridge (^1.6)

I don't know what this means. Does it mean that when laminas is removed "root" and "dev-master" won't work? I don't understand it.

Is it safe to remove this package?

Composer.json:

{
    "type": "project",
    "license": "proprietary",
    "require": {
        "php": ">=8.2.12",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "composer/package-versions-deprecated": "1.11.99.1",
        "doctrine/annotations": "^1.0",
        "doctrine/doctrine-bundle": "^2.3",
        "doctrine/doctrine-migrations-bundle": "^3.1",
        "doctrine/orm": "^2.8",
        "laminas/laminas-zendframework-bridge": "^1.6",
        "phpdocumentor/reflection-docblock": "^5.2",
        "symfony/asset": "6.4.*",
        "symfony/console": "6.4.*",
        "symfony/dotenv": "6.4.*",
        "symfony/expression-language": "6.4.*",
        "symfony/flex": "^1.3.1",
        "symfony/form": "6.4.*",
        "symfony/framework-bundle": "6.4.*",
        "symfony/http-client": "6.4.*",
        "symfony/intl": "6.4.*",
        "symfony/mailer": "6.4.*",
        "symfony/monolog-bundle": "^3.7",
        "symfony/password-hasher": "6.4.*",
        "symfony/process": "6.4.*",
        "symfony/property-access": "6.4.*",
        "symfony/property-info": "6.4.*",
        "symfony/proxy-manager-bridge": "6.4.*",
        "symfony/runtime": "6.4.*",
        "symfony/security-bundle": "6.4.*",
        "symfony/translation": "6.4.*",
        "symfony/twig-bundle": "^6.4",
        "symfony/validator": "6.4.*",
        "symfony/web-link": "6.4.*",
        "symfony/webpack-encore-bundle": "^1.11",
        "symfony/yaml": "6.4.*",
        "symfonycasts/reset-password-bundle": "^1.7",
        "symfonycasts/verify-email-bundle": "^1.4",
        "twig/extra-bundle": "^2.12|^3.0",
        "twig/twig": "^2.12|^3.0"
    },
    "require-dev": {
        "doctrine/doctrine-fixtures-bundle": "^3.4",
        "rector/rector": "^1.2",
        "symfony/browser-kit": "^6.4",
        "symfony/css-selector": "^6.4",
        "symfony/debug-bundle": "^6.4",
        "symfony/maker-bundle": "^1.30",
        "symfony/phpunit-bridge": "^6.4",
        "symfony/stopwatch": "^6.4",
        "symfony/var-dumper": "^6.4",
        "symfony/web-profiler-bundle": "^6.4"
    },
    "config": {
        "preferred-install": {
            "*": "dist"
        },
        "sort-packages": true,
        "allow-plugins": {
            "symfony/flex": true,
            "symfony/runtime": true
        }
    },
    "autoload": {
        "psr-4": {
            "App\\": "src/"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "App\\Tests\\": "tests/"
        }
    },
    "replace": {
        "paragonie/random_compat": "2.*",
        "symfony/polyfill-ctype": "*",
        "symfony/polyfill-iconv": "*",
        "symfony/polyfill-php71": "*",
        "symfony/polyfill-php70": "*",
        "symfony/polyfill-php56": "*"
    },
    "scripts": {
        "auto-scripts": {
            "cache:clear": "symfony-cmd",
            "assets:install %PUBLIC_DIR%": "symfony-cmd"
        },
        "post-install-cmd": [
            "@auto-scripts"
        ],
        "post-update-cmd": [
            "@auto-scripts"
        ]
    },
    "conflict": {
        "symfony/symfony": "*"
    },
    "extra": {
        "symfony": {
            "allow-contrib": false,
            "require": "6.4.*"
        }
    }
}

Answer 1

Nothing in Symfony intrinsically depends on laminas/laminas-zendframework-bridge. If you had it installed, it was because some other dependency required it (or you thought it required it).

This

$ composer depends laminas/laminas-zendframework-bridge

__root__  dev-master  requires  laminas/laminas-zendframework-bridge (^1.6)

Only means that the dependency exists at "root level". Meaning, it is declared in your own composer.json explicitly, in the require section.

The message is telling you: "this is a direct dependency, declared by you; no other dependency in your project declares a dependency on this package".

So with that information, you should be able to remove the package.

But of course, you should make sure that your own code is not using the package first. Since you do not seem to depend on anything else related to Laminas, you should be safe. But use common-sense and test your code.