composer update pulls in packages ignoring require.php constraints
#11164
-
|
I have Concrete problem case {
"name": "herndlm/composer-update-constraints",
"type": "library",
"require": {
"php": "^7.4 || ^8.0",
"league/commonmark": "^2.3"
},
"autoload": {
"psr-4": {
"Herndlm\\ComposerUpdateConstraints\\": "src/"
}
}
}installs the indirect dependency I created a reproducer at https://github.com/herndlm/composer-update-constraints and let Renovate update the lockfile in https://github.com/herndlm/composer-update-constraints/
8000
pull/3/files#r1009228391. It does that using the latest composer (2.4.4) and latest PHP (8.1.12) that are in reach for me using the following command: |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
|
from my experience composer always installs the highest version of packages that are compatible with the system's version of the docs allude to this behaviour, implying that the
i currently have to support packages for
it's worth noting that the |
Beta Was this translation helpful? Give feedback.
-
|
I was really not expecting it to work like that, but https://getcomposer.org/doc/articles/composer-platform-dependencies.md#what-are-platform-dependencies also has an example that shows how it works internally and I can see now how this happens. That means 8.1 will break the lockfile basically and I have to run it with the lowest supported php version or define a platform constraint :/ |
Beta Was this translation helpful? Give feedback.
-
|
Yup, best is to define config.platform.php IMO. Or do not ship a lock file if it's a library that can be used with several PHP versions.. |
Beta Was this translation helpful? Give feedback.
from my experience composer always installs the highest version of packages that are compatible with the system's version of
phpand the^7.4 || ^8.0in the root package is used to print warnings if trying to runcomposer updateon a machine without a satisfactory version:the docs allude to this behaviour, implying that the
phpconstraint is for the user:i currently have to support packages for
7.4and8.1, and to work with this i install both versions of php locally and use the following commands:php7.4 $(which composer) updatephp8.1 $(which composer) updateit's worth noting that the
phpconstraint is considered when requiring packages in…