here is my solution, because i do not want to wait for joomshaper to react (could be months, if ever, since scssphp is not maintained by joomshaper)

get scssphp version

\plugins\system\helixultimate\vendor\scssphp\scssphp\src\Version.php

const VERSION = '1.11.1';

find all occurrences

cd joomla site folder

findstr /S /N /I /C:"= null" plugins\system\helixultimate\vendor\scssphp\scssphp\src*.php > bad.txt

verify each line in bad.txt, change only typed nullable declarations

example:

from > Environment $env = null

to > ?Environment $env = null

verify after update

php -l plugins\system\helixultimate\vendor\scssphp\scssphp\src\Compiler.php php -l plugins\system\helixultimate\vendor\scssphp\scssphp\src\Formatter.php php -l plugins\system\helixultimate\vendor\scssphp\scssphp\src\Node\Number.php php -l plugins\system\helixultimate\vendor\scssphp\scssphp\src\Parser.php php -l plugins\system\helixultimate\vendor\scssphp\scssphp\src\Warn.php

No syntax errors detected

restart apache

clear joomla cache

now with joomla debug enabled and maximum error reporting the deprecated warnings are gone, after all just 5 php files had bad occurrences where i simply updated the typed nullable declarations (as php 8.4.x would expect).

it took me max. 1 hour to find, isolate and fix the problem, i am deeply disappointed of joomshaper to not fix that problem on their own.

for my next projects i will look into other solutions (like wp) because the laziness and terrible security handling is very dangerous in times like these.

A few days ago, I already raised this concern in a couple of tickets where the 2.2.9 RC version had been published. I pointed out that several third-party libraries appeared to have been downgraded.

For example, when comparing the SCSSPHP dependency, it has gone from version 2.1.0, which is currently the latest release, back to version 1.11.1—an outdated and deprecated version released almost three years ago, in October 2023.

SCSSPHP Comparison Between HelixUltimate 2.2.8 and 2.2.9

At the time, they mentioned that this would be reviewed. However, instead of moving to newer and presumably more secure versions, the final release appears to revert to obsolete dependencies that have not been maintained for years.

Could you please clarify why these dependencies were downgraded and whether you plan to update them in upcoming releases?

Given everything that has happened over the past few weeks, it's important to proceed with extreme caution with every new version that is published.

Hi there,

Thank you for reaching out, and I apologize for any inconvenience this issue may have caused. I have already informed our team about your issue, and they are looking into it. Please allow us some time to investigate. As soon as I receive an update from our team, I will let you know.

Best regards,

Toufiqur Rahman (Team Lead, Support)

Hi there,

Thank you for reaching out, and I apologize for any inconvenience this issue may have caused. I have already informed our team about your issue, and they are looking into it. Please allow us some time to investigate. As soon as I receive an update from our team, I will let you know.

Best regards,

Toufiqur Rahman (Team Lead, Support)

Aside from that, why were these styles removed in version 2.2.9? Was it accidental?

https://limewire.com/d/D62jA#pAVfCOh9IH

We have also noticed another similar cleanup issue after updating to Helix Ultimate 2.2.9.

As mentioned before with the SCSSPHP downgrade, and also with the CSS presets that no longer seem to be included in 2.2.9 but remain on the website after updating, it looks like the installer/update process does not remove obsolete files or folders from previous versions.

In this case, after updating to Helix Ultimate 2.2.9, some old third-party vendor folders remain on the server under:

/plugins/system/helixultimate/vendor

For example:

/league
/psr
/symfony

However, these folders do not appear to be present in a clean Helix Ultimate 2.2.9 package.

https://limewire.com/d/m8FvV#p1f10U5uhR

We also noticed that an old file still remains in the updated installation:

/plugins/system/helixultimate/vendor/composer/autoload_files.php

This file still references Symfony polyfills:

/vendor/symfony/polyfill-ctype/bootstrap.php
/vendor/symfony/polyfill-mbstring/bootstrap.php

However, in the clean 2.2.9 package, the current Composer autoload files only seem to reference:

scssphp/scssphp
tedivm/jshrink
HelixUltimate\Framework
Composer\InstalledVersions

Also, autoload_real.php does not appear to require autoload_files.php, so this looks like another leftover file from a previous version.

Could you please confirm whether these old vendor folders/files are obsolete in Helix Ultimate 2.2.9?

If they are no longer required, could you please add a cleanup step to the Helix Ultimate installer/update script so obsolete vendor folders, Composer autoload files and old preset files are removed automatically during future updates?

I think this is important for maintenance and security, because outdated third-party dependencies or old preset files may remain on the filesystem after an update, even if they are no longer used by the current version.

I would prefer not to manually delete files from production sites, because the /vendor directory and Composer autoload files should stay synchronized with the official package and installer.

Hi Toufiq If you decide to fix this by updating Helix Ultimate 2.2.9 rather than creating Helix Ultimate 2.2.10, will you let us know so we can download the updated files please? Thanks

Hi Toufiq,

Do you have any updates on the issues discussed in this thread?

• Why some third-party libraries have been downgraded to obsolete versions.
• Why some CSS style presets weren't included in the latest version.
• Why the installer doesn’t include a script to remove obsolete files from previous versions that no longer exist in newer versions, such as certain third-party libraries like Symfony that have been removed in the latest version.

Thanks.