# Vendor Review

Date: 2026-04-26

This review covers bundled third-party libraries under `vendor/` for P7-DEBT-04.

## Findings

| Library | Local version | Finding | Action |
|---|---:|---|---|
| PHPMailer | 5.2.23 | Legacy 5.x branch; local code called removed PHP 8 function `get_magic_quotes_runtime()` while encoding attachments. | Patched the PHP 8 compatibility guard in `vendor/phpmailer/class.phpmailer.php`. Plan controlled upgrade to PHPMailer 6.x in a maintenance window. |
| Pusher PHP server | 4.1.5 | Composer-managed package, PHP 8 compatible by declared constraints. | Keep for release candidate; upgrade through Composer-managed package refresh after target-host testing. |
| paragonie/sodium_compat | 1.14.0 | Bundled through Pusher dependency tree. | Prefer native `ext-sodium` on production; refresh with Pusher upgrade. |
| chart.min.js, moment.min.js, daterangepicker.min.js, editorjs.js, lame.min.js | vendored browser assets | No package lock or source manifest in this repo, so version provenance is limited. | Do not replace blindly before launch. Record exact assets in release manifest and refresh as a dedicated frontend dependency task. |

## Release Decision

No critical vendor runtime blocker remains for the current release candidate after the PHPMailer PHP 8 guard. A full vendor modernization remains recommended, but it should be done as a controlled dependency update with regression testing for email sending, attachments, Pusher realtime events, reports charts, date range picker, editor, and audio recording.

## Post-Launch Upgrade Target

- Move PHPMailer 5.x to PHPMailer 6.x and update mail creation code to namespaced classes.
- Refresh Pusher and Composer dependencies through Composer, not by copying partial vendor trees.
- Add a dependency manifest or lock file for browser assets.
- Re-run `php logs/smoke_test_release.php`, email attachment tests, and admin UI smoke tests after dependency upgrades.