search

Roave / SecurityAdvisories

:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily
MIT License
2.69k stars 104 forks source link

Conflict on package rename ? #122

Closed jrfnl closed 9 months ago

jrfnl commented 9 months ago

Hi @Ocramius I just ran into an interesting conflict on which I wouldn't mind a second pair of eyes/some advise.

I'm setting up some PRs to switch various PHPCS external standards to the new fork for PHPCS. As these are external standards, they use dev-master in certain places in CI.

Now this is a conflict I ran into for one of these:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires phpcsstandards/php_codesniffer dev-master -> satisfiable by phpcsstandards/php_codesniffer[dev-master].
    - roave/security-advisories dev-master conflicts with squizlabs/php_codesniffer >=1,<2.8.1|>=3,<3.0.1 (phpcsstandards/php_codesniffer dev-master replaces squizlabs/php_codesniffer > 2.0).
    - Root composer.json requires roave/security-advisories dev-master -> satisfiable by roave/security-advisories[dev-master].

Commit: https://github.com/PHPCSStandards/PHPCSDevTools/commit/5e787859cdf0e390401b3aa7878d2761c529808d Workflow script: https://github.com/PHPCSStandards/PHPCSDevTools/blob/feature/switch-to-fork-of-phpcs/.github/workflows/cs.yml Build log: https://github.com/PHPCSStandards/PHPCSDevTools/actions/runs/7064957528/job/19233994486

It goes without saying that using dev-master for the original squizlabs package did not run into this issue.

Any suggestions//advise ?

jrfnl commented 9 months ago

Hmm.. I think I may have figured it out, though still wouldn't mind someone verifying - see https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/113

Ocramius commented 9 months ago

self.version seems valid.

I'm unsure where phpcsstandards/php_codesniffer:dev-master is placed by composer, though: the conflicts in here will apply to squizlabs/php_codesniffer, and be projected also on the package that declares replace: in the same way.

Ocramius commented 9 months ago

IMO solved by moving to self.version (correct approach).

I think your branch-alias leads to 3.x-dev being inferred there

jrfnl commented 8 months ago

@Ocramius Thanks for your feedback!

jrfnl commented 8 months ago

Just in case anyone comes across this issue: the PHP_CodeSniffer package name has stayed the same and no action is needed to get the latest PHP_CodeSniffer releases.