What is the best practice for handling abandoned packages required by the drupal core?

Question

When I run composer update on a Drupal 9 website, I get this warning:

Package doctrine/reflection is abandoned, you should avoid using it. Use roave/better-reflection instead.

A similar question has alreday been asked, answered and accepted on StackOverflow.

To summarise the accepted answer:

• edit your composer.json and replace the abandoned package with the recommended replacement
• then run composer update again

I seriously doubt that manually altering composer.json is the best practice, but that is moot, because it does not apply in the case of "doctrine/reflection". When looking into my composer.json, there is no mention of it, so there is nothing to edit.

So I am checking why it is required:

$ composer why doctrine/reflection
doctrine/common          2.13.3  requires  doctrine/reflection (^1.0)   
doctrine/persistence     1.3.8   requires  doctrine/reflection (^1.2)   
drupal/core              9.1.7   requires  doctrine/reflection (^1.1)   
drupal/core-recommended  9.1.7   requires  doctrine/reflection (1.2.2)  

So this abandoned package is required by drupal/core (and others).

In an upvoted commnent, user Kay V writes:

People needing more generic composer usage instructions should consider $ composer remove {{old package}} and then $ composer require {{new package}}.

This doesn't work either, it produces the following messages:

doctrine/reflection is not required in your composer.json and has not been removed [...]
Removal failed, doctrine/reflection is still present, it may be required by another package. See composer why doctrine/reflection.

Two questions:

1. Why is the most recent version of drupal/core requiring an abandoned package (instead of its recommended replacement roave/better-reflection)?
2. What is the best practice for handling abandoned packages required by the drupal core?

Answer 1

This is not really an answer since you asked for 'best practice', but it does work. Considering

The code from doctrine/reflection has been copied to drupal/components.
The code from doctrine/reflection is no longer been used in core.

(#39 in the official thread https://www.drupal.org/project/drupal/issues/3180351), I would say that the package can just be ignored with composers replace top-level keyword:

"replace": {
    "doctrine/reflection": "*"
}

This only works since the package is not only abandoned, but completely unnecessary for Drupal to function, so we can safely skip the download.

There is a thread on the composer GitHub with an interesting solution proposal to add a new top-level keyword suppress that would behave more elegantly: https://github.com/composer/composer/issues/6133#issuecomment-1040176900