[yansongda]

Summary

egulias/email-validator is declared in require, but nothing in this package uses it:

• No Egulias reference anywhere in src/ or tests/. A repo-wide search only matches the composer.json declaration itself.
• None of the runtime dependencies pull it in either: symfony/mime (6.4 and 7.x) has neither a require nor a suggest entry for it, and zbateson/mail-mime-parser does not reference it.
• The package never asks for strict address validation, so the validator is never instantiated.

Why it matters

An unused dependency in require is not free: it becomes a hard constraint for every consumer. This one pins ^4.0, which conflicts with packages still on ^3.0, such as hyperf/validation (verified on v3.2.5 and on master). The two ranges do not intersect, so those projects cannot install ImapEngine at all today, even though neither side uses the validator.

There is a related PR open on the Hyperf side (hyperf/hyperf#7833) that relaxes their constraint to ^3.0 || ^4.0. That fix and this one are complementary rather than redundant: relaxing the constraint downstream widens the intersection, while dropping the unused requirement here removes the reason for the pin in the first place. This package needs nothing from egulias, so it should not constrain which major version a consumer uses.

For reference, illuminate/validation has accepted ^3.2.1|^4.0 / ^3.2.5|^4.0 since 9.x, so there is no conflict on the Laravel side — the Hyperf case is the one that surfaces.

Change

composer.json only, one line removed:

@@ -19,8 +19,7 @@
         "symfony/mime": ">=6.0",
         "nesbot/carbon": ">=2.0",
         "illuminate/collections": ">=9.0",
-        "zbateson/mail-mime-parser": "^3.0|^4.0",
-        "egulias/email-validator": "^4.0"
+        "zbateson/mail-mime-parser": "^3.0|^4.0"
     },
     "require-dev": {

No source code changes, so behaviour is unchanged.

Verification

• Nothing in the dependency tree requires egulias/email-validator transitively, so this is the only change in resolution.
• Since no source file is touched, the existing test suite is unaffected. CI (run-tests and run-integration-tests) runs on this PR for the usual matrix.

Alternative

If you would rather keep the dependency for backward compatibility, the constraint can be relaxed to ^3.0 || ^4.0 instead of being removed. I'm happy to switch this PR to that approach.

[stevebauman]

Thanks for the PR @yansongda! This appears to be incorrect and required by downstream Symfony:

https://github.com/DirectoryTree/ImapEngine/actions/runs/40491322988/job/125518679745

I'll see if there's a way around this to avoid having to use the dependency.

[stevebauman]

Ok I dug into this a bit more. We do need Egulias because DraftMessage uses Symfony’s email composer, which validates sender and recipient addresses internally.

However, we don’t need to restrict it to ^4.0. Broadening the constraint to ^3.0|^4.0 should resolve the conflict with Hyperf while keeping that functionality intact. Symfony already excludes the incompatible 3.0.x releases.

I tested with Egulias 3.2.6 and 4.0.4, and the unit and integration suites pass with both. I've updated this PR to broaden the constraint instead of removing the dependency.

We can investigate removing it entirely in another issue + PR so we can patch this now quick.

[yansongda]

Thanks for digging into this instead of just closing it. My grep only covered src/ and tests/, so I missed that Mime\Address needs egulias at runtime. Keeping it was the right call, and ^3.0|^4.0 is a better fix than what I proposed anyway. Thanks for running it against 3.2.6 and 4.0.4 yourself

[stevebauman]

Happy to help @yansongda!