search

Roave / SecurityAdvisories

:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily
MIT License
2.7k stars 105 forks source link

Strange behavior with laminas/laminas-diactoros #130

Closed charithar closed 6 months ago

charithar commented 6 months ago

I have PHP 7.4 (yes it's old but required for legacy system) and composer 2.7 in my environment. I have the laminas/laminas-diactoros 2.8.0 installed in the project. When I try to add roave/security-advisories package it reports following error.

What can I do about it? Thanks.

Ocramius commented 6 months ago

What's the weird behaviour?

charithar commented 6 months ago

What's the weird behaviour?

Sorry. I prematurely submitted the question previously. Updated the question again with details again. Seems like it shouldn't behave like that with the version constraints.

Ocramius commented 6 months ago

Why not? Some advisories are very limited in scope, and the ranges there don't seem to overlap 🤔

Ocramius commented 6 months ago

Btw, the error in OP is legit: you should upgrade

charithar commented 6 months ago

Seems like that there is a problem with version of laminas/laminas-diactoros package. Their github page doesn't show a 2.8.x version but such version gets installed when it's specified. Anyway, thank you very much for the reply. I'll need to update the PHP version to get rid of the conflict warning.

Ocramius commented 6 months ago

It's there?

charithar commented 6 months ago

It's there?

Yeah. I managed to install it forcefully before. It should not trigger the conflict according to the constraints above I guess but it did. Not sure why.

Ocramius commented 6 months ago

and an update of this package was not requested.

It was probably too many arguments (or too restrictive arguments) passed to composer update :)