thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.49k stars 1.12k forks source link

Tweaked version constraints #1336

Closed GrahamCampbell closed 1 year ago

GrahamCampbell commented 1 year ago

The important change is the PHP version. It is too late to apply an upper-bound in a major release series - composer will just go and get v8.4.1 instead of v8.5.0 which is definitely worse. ;)

parallels999 commented 1 year ago

is this for fixing this downgrading?

Package operations: 1 install, 2 updates, 0 removals
  - Installing stella-maris/clock (0.1.7): Extracting archive
  - Downgrading lcobucci/clock (3.0.0 => 2.3.0): Extracting archive
  - Upgrading league/oauth2-server (8.4.1 => 8.5.0): Extracting archive
Sephster commented 1 year ago

Thanks Graham. I didn't think of that but makes sense. Will merge soon. Much appreciated 👍

GrahamCampbell commented 1 year ago

@parallels999 No that is not related. Can you run composer why lcobucci/clock please, so we can see why it couldn't install lcobucci/clock 3.0.0?

parallels999 commented 1 year ago
composer why lcobucci/clock
lcobucci/jwt         4.3.0 requires lcobucci/clock (^2.0 || ^3.0)     
league/oauth2-server 8.5.0 requires lcobucci/clock (^2.2.0 || ^3.1.0) 
GrahamCampbell commented 1 year ago

Ohh, it's because lcobucci/clock 3.1.0 requires PHP 8.2. We should probably change the version constraint in this package to allow 3.0 as well as 3.1.

parallels999 commented 1 year ago

You're right, I'm using PHP 8.1, I don't plan on upgrading to 8.2 yet

GrahamCampbell commented 1 year ago

I've adjusted the version constraint down to ^3.0, here.

Sephster commented 1 year ago

Thanks @GrahamCampbell