title: What is the best practice for handling composer abandoned packages?
body: <p>When I run composer updates I'll occasionally get messages that packages are abandoned and I should use a different one instead, like <code>Package webflo/drupal-core-require-dev is abandoned, you should avoid using it. Use drupal/core-dev instead.</code> I don't have experience with Composer so I'm curious as to what is seen as the best practice for replacing outdated packages.</p>
  
  <p>Where do these messages come from? I'm unsure if the source is always reliable.</p>