Suppress Drush sanitize plugin deprecation notices during provisioning

[AlexSkrypnyk]

Summary

vortex-provision-sanitize-db prints 4 deprecation notices on every run, plus a confirmation preamble that nobody is around to answer because the call already passes -y. None of it is actionable: the notices are Drush complaining about Drush.

 [INFO] Sanitizing database.
 [notice] The Drush\Commands\sql\sanitize\SanitizeCommentsCommands::messages sanitize plugin is using a deprecated API. See https://www.drush.org/13.x/listeners/
 [notice] The Drush\Commands\sql\sanitize\SanitizeSessionsCommands::messages sanitize plugin is using a deprecated API. See https://www.drush.org/13.x/listeners/
 [notice] The Drush\Commands\sql\sanitize\SanitizeUserFieldsCommands::messages sanitize plugin is using a deprecated API. See https://www.drush.org/13.x/listeners/
 [notice] The Drush\Commands\sql\sanitize\SanitizeUserTableCommands::messages sanitize plugin is using a deprecated API. See https://www.drush.org/13.x/listeners/
The following operations will be performed:
 * Sanitize text fields associated with users.
 * Sanitize user passwords.
 * Sanitize user emails.
 * Preserve user emails and passwords for the specified roles.

The same block is baked into the recorded provision demo shipped with the docs (.vortex/docs/static/img/provision.json and provision.svg), so it is on the website too.

This is an upstream Drush bug

SanitizeCommands::sanitize() logs a notice for every sanitize plugin still registered through the legacy #[CLI\Hook(...)] API rather than the newer event listeners:

$handlers = $this->getCustomEventHandlers(self::CONFIRMS);
foreach ($handlers as $handler) {
    $handler($messages, $this->input());
    $stringCallable = (is_string($handler[0]) ? $handler[0] : get_class($handler[0])) . '::' . $handler[1];
    $this->logger()->notice('The {handler} sanitize plugin is using a deprecated API. See {url}', [...]);
}

The 4 plugins it names are Drush's own bundled ones, and on 13.x they still carry #[CLI\Hook(type: HookManager::ON_EVENT, target: SanitizeCommands::CONFIRMS)]. So Drush warns about itself, on every run, and there is nothing a Vortex-based project can do about it from its own code.

Already fixed on 14.x, not on 13.x. drush-ops/drush#6415 ("Convert sql:sanitize to Console", merged 2025-10-22) removed the 4 bundled plugin classes outright, so the notice has nothing left to fire on there. 14.x now ships only SanitizeCommand.php, SanitizeCommands.php and SanitizePluginInterface.php.

There is no 14.x tag yet. 13.7.6 is the current stable and 13.x HEAD still carries both the legacy plugins and the notice, so there is no release to upgrade to. A search of the Drush queue turned up no existing report for the 13.x case.

Why the notices are visible at all. consolidation/log maps LogLevel::NOTICE to VERBOSITY_VERBOSE, which would hide them by default, but Robo\Log\RoboLogger remaps it back to VERBOSITY_NORMAL.

Resolution

Clears itself when Vortex moves to Drush 14. Until then this is a tracking issue: the noise is cosmetic, sanitization itself works correctly, and the fix belongs upstream rather than in vortex-provision-sanitize-db.

Affected

• .vortex/tooling/src/vortex-provision-sanitize-db
• .vortex/docs/static/img/provision.json and provision.svg - recorded demo carries the noise