[4.x]: Update via Control Panel ignores Composer Version Constraints

mfell commented 6 months ago

What happened?

Description

My usecase: I want to keep craft-neo within it's major version 3.x (3.9.11 and 4.0.0 are available)
I set the wanted version in composer.json to "spicyweb/craft-neo": "^3.9.10"
I would expect Craft control panel choses version 3.9.11 (because of ^) -> this is the bug
It works correctly via console command: composer update -> Version 3.9.11 is chosen
Control Panel offers Version 4.0.0 and after click on "update": Sets the Version to "spicyweb/craft-neo": "4.0.0"

Maybe this behaviour is the default for the CP ... but for this case it's still very confusing for me.

It would be very useful to get the information, that Version 4.0.0 is available but if a version constraint is set in composer.json, I want to be sure, that there is no update to next major release of a plugin, until I remove the version constraint in composer.json?

Steps to reproduce

composer.json: "spicyweb/craft-neo": "^3.9.10"
CP: Update Neo

Expected behavior

Use version 3.9.11

Actual behavior

Version 4.0.0 is chosen

Craft CMS version

4.5.13

PHP version

No response

Operating system and version

No response

Database type and version

No response

Image driver and version

No response

Installed plugins and versions

    "carlcs/craft-redactorcustomstyles": "4.0.3",
    "craftcms/cms": "4.5.13",
    "craftcms/feed-me": "5.3.0",
    "craftcms/redactor": "3.0.4",
    "doublesecretagency/craft-cpcss": "2.6.0",
    "doublesecretagency/craft-cpjs": "2.6.0",
    "ether/seo": "4.2.1",
    "nystudio107/craft-vite": "4.0.7",
    "robuust/craft-reverserelations": "2.0.0",
    "sebastianlenz/linkfield": "^2.1",
    "spicyweb/craft-embedded-assets": "3.2.0",
    "spicyweb/craft-neo": "^3.9.10",
    "verbb/field-manager": "3.0.8",
    "verbb/user-group-field": "3.0.1",
    "vlucas/phpdotenv": "^5.4.0",
    "xpertbot/craft-wheelform": "3.1.7"

brandonkelly commented 6 months ago

It might be a good idea for the Updates utility to do a better job highlighting all major plugin updates, and maybe provide the option to update to the latest version within the current major version instead. That wouldn’t be based on composer.json constraints, though.

When you use the Updates utility, the resulting composer.json file will set craftcms/cms and plugin package constraints to the exact version you installed (no ^ or ~), such as "carlcs/craft-redactorcustomstyles": "4.0.3" above. ¹ So if the Updates utility started respecting composer.json constraints, it would be sticking with the current version for all packages by default.

¹ It does that to protect you from accidentally updating the plugin via composer update which, if the plugin license has expired, would update you to a version you aren’t licensed to use, unexpectedly requiring you to pay to renew the license.

mfell commented 6 months ago

Yo ... thank you Brandon for you comment! I agree, this would be a good idea, too.

It's not necessary, to protect the Updates Utility -> an Admin has to know, what he's doing. But with this concept, I have to chance to use the Update Utility -> which is know a little bit useless for me.

craftcms / cms