vimeo/psalm:dev-master requires composer/semver:^2 or ^3

mortenson / psalm-plugin-drupal

A project to add Psalm support for Drupal for security testing, focused only on taint analysis.

Other

43 stars 7 forks source link

vimeo/psalm:dev-master requires composer/semver:^2 or ^3 #2

Closed xurizaemon closed 3 years ago

xurizaemon commented 3 years ago

vimeo/psalm (as of vimeo/psalm@5ecab7b9e70f9c9894b66afcc2005ab8430da682) requires composer/semver ^2 || ^3
drupal/core-recommended:8.9.13 requires composer/semver:1.5.1 (here)
vimeo/psalm:4.6.4 may be the last version that works with Drupal 8.9?
nope, 4.6.4 lacks RemoveTaintInterface, trying mortenson/psalm-plugin-drupal:dev-master#4aabb411a8e90cf1fb465a687c093e549e1212aa and vimeo/psalm:dev-master#2edf61399a4f85a3c9dbd76d5fe204aa7231ed55 ...

Opening an issue to discuss / share solution.

mortenson commented 3 years ago

Thanks for looking into this!

4.6.4 came out before RemoveTaintInterface was added - that's why we're tied to dev-master right now. When a new release comes out I'll update composer.json.

It looks like Drupal 9.1.x+ uses semver 3, so I can update the README to say that's the minimum version of Drupal. This project is brand new and Drupal 8 is end of life'd in November so that seems OK.

xurizaemon commented 3 years ago

Happy for that, and thanks for confirming the status. Look forward to trying it on a D9 project next 😁

muglug commented 3 years ago

Also I've added a hack to allow older composer/semver versions in Psalm