Let's not use unbound version constraints

paragonie / random_compat

PHP 5.x support for random_bytes() and random_int()

https://paragonie.com/projects

MIT License

8.16k stars 145 forks source link

Let's not use unbound version constraints #182

Closed pH-7 closed 10 months ago

pH-7 commented 1 year ago

And this will fail composer validate as well.

Further information: https://getcomposer.org/doc/faqs/why-are-unbound-version-constraints-a-bad-idea.md

paragonie-security commented 10 months ago

This library is an exception to that rule.

If you're on PHP 7, this package should be a NOP. That's what version 9 provides.
If you're not, version 2 gives you a secure polyfill.

The correct way to tell Composer "install version 2 on 5.6 or older, but 9 on 7 or later" is for us to set the constraints appropriately, and for everyone else to say >= 2 and call it a day.

pH-7 commented 10 months ago

That makes it clear 👍