When I run composer update on a Drupal 9 website, I get this warning:

Package doctrine/reflection is abandoned, you should avoid using it. Use roave/better-reflection instead.

A similar question has alreday been asked, answered and accepted on StackOverflow.

To summarise the accepted answer:

• edit your composer.json and replace the abandoned package with the recommended replacement
• then run composer update again

I seriously doubt that manually altering composer.json is the best practice, but that is moot, because it does not apply in the case of "doctrine/reflection". When looking into my composer.json, there is no mention of it, so there is nothing to edit.

So I am checking why it is required:

$ composer why doctrine/reflection doctrine/common          2.13.3  requires  doctrine/reflection (^1.0)    doctrine/persistence     1.3.8   requires  doctrine/reflection (^1.2)    drupal/core              9.1.7   requires  doctrine/reflection (^1.1)    drupal/core-recommended  9.1.7   requires  doctrine/reflection (1.2.2)   

So this abandoned package is required by drupal/core (and others).

In an upvoted commnent, user Kay V writes:

People needing more generic composer usage instructions should consider $ composer remove {{old package}} and then $ composer require {{new package}}.

This doesn’t work either, it produces the following messages:

doctrine/reflection is not required in your composer.json and has not been removed […]
Removal failed, doctrine/reflection is still present, it may be required by another package. See composer why doctrine/reflection.

Two questions:

1. Why is the most recent version of drupal/core requiring an abandoned package (instead of its recommended replacement roave/better-reflection)?
2. What is the best practice for handling abandoned packages required by the drupal core?