valorin / pwned-validator

Super simple Laravel Validator for checking password via the Pwned Passwords service of Have I Been Pwned
MIT License
383 stars 24 forks source link

Update composer.json #8

Closed lionslair closed 5 years ago

lionslair commented 5 years ago

Add compatibility with Laravel 6.1

limenet commented 5 years ago

@lionslair thank you for this PR, I was about to do the same!

Since Laravel, starting with 6.0, now follows Semantic Versioning, the constraint could safely also be ^6.0 instead of ~6.0.0||~6.1.0. What do you think?

lionslair commented 5 years ago

I have been having the issue on a number of packages. Seems to need one for each version. eg on spatie packages

https://github.com/spatie/laravel-medialibrary/blob/master/composer.json

they had to do it for each version 5.5|| 5.6 etc

What you maybe could do is add for the next few versions now.

eg 6.0||6.1|6.2||6.3

maybe?

limenet commented 5 years ago

Historically, e.g. Laravel 5.6 was not necessarily backwards compatible with 5.5 as you'd expect from most packages. However, starting with version 6.0, e.g. 6.1 is backwards compatible with 6.0.

This resulted in many packages maintainers explicitly stating compatibility with a certain version, e.g. 5.6 instead of e.g. ^5.0 as sometimes different code was necessary for e.g. 5.7 and 5.6.

Due to the change from 5.x to 6.x you can safely list ^6.0 as version constraint instead of e.g. ~6.0 | ~6.1 | ~6.2. You'll also find the spatie package you mentioned now uses ^6.0 as the constrain for the 6.x branch of Laravel: https://github.com/spatie/laravel-medialibrary/blob/master/composer.json#L30

Does this make sense?

lionslair commented 5 years ago

So this should already work?

limenet commented 5 years ago

It will work for now, but it's no future-proof yet :) (and considering Laravel 6.1 was released not long after 6.0, I wouldn't be surprised if we saw 6.2 soon)

I suggest you change:

"illuminate/support": "~5.5.0||~5.6.0||~5.7.0||~5.8.0||~6.0.0||~6.1.0"

to:

"illuminate/support": "~5.5.0||~5.6.0||~5.7.0||~5.8.0||^6.0"

You can see how the different constraints play out e.g. here: ~6.0.0||~6.1.0 vs ^6.0.

lionslair commented 5 years ago

talking about 6.2 already https://blog.laravel.com/password-confirmation

valorin commented 5 years ago

Sorry I haven't weighed in before.

What about changing it to ^5.5||^6.0? It makes it a lot simpler, and should still support all the right versions.

Side note, https://jubianchi.github.io/semver-check/ is awesome! 😀

limenet commented 5 years ago

@valorin no worries, thanks for chiming in!

^5.5||^6.0 is a perfectly good idea since it's reasonable to assume no Laravel 5.9 is going to be released (and if it were, it's hopefully not backwards-incompatible) and it looks much cleaner, too.

lionslair commented 5 years ago

Updated based on comments

limenet commented 5 years ago

@valorin can we please get this merged asap? This is keeping projects using this package from updating to Laravel 6.1/6.2. Thank you!

valorin commented 5 years ago

I'm so sorry for the delay! I've pushed out 1.3.1, which uses ^5.5||^6.0 for the versions. It should let you use all the 6.* versions you desire. 😁

limenet commented 5 years ago

Thank you so much. @valorin !