composer require wp-cli/wp-cli-bundle:~2.3.0 installs 2.4.0-alpha?

[lkraav]

Bug Report

Is your bug report directly related to a specific command?

No.

Are you unsure about what repository to post the bug report into?

I am sure.

--- ✅ If you are in the correct location now... --->

• [x] Yes, I reviewed the contribution guidelines.
• [x] Yes, more specifically, I reviewed the guidelines on how to write clear bug reports.

Describe the current, buggy behavior

I was trying to get a wp executable of latest stable version 2.3.0.

$ composer require wp-cli/wp-cli-bundle:~2.3.0

But after installation:

$ [git:master+?{1}] public/vendor/bin/wp cli info
OS:     Linux 5.3.0-rc8-gentoo+ #101 SMP PREEMPT Tue Sep 10 18:09:37 EEST 2019 x86_64
Shell:  /bin/bash
PHP binary:     /usr/bin/php
PHP version:    7.3.9
php.ini used:   /etc/php/cli-php7.3/php.ini
WP-CLI root dir:        /home/leho/Documents/cxl-wpstarter.git/public/vendor/wp-cli/wp-cli
WP-CLI vendor dir:      /home/leho/Documents/cxl-wpstarter.git/public/vendor
WP_CLI phar path:
WP-CLI packages dir:
WP-CLI global config:
WP-CLI project config:  /home/leho/Documents/cxl-wpstarter.git/wp-cli.yml
WP-CLI version: 2.4.0-alpha

Describe how other contributors can replicate this bug

See above.

Describe what you would expect as the correct outcome

I expected to get "WP-CLI version: 2.3.0"

Let us know what environment you are running this on

See above.

Provide a possible solution

I am unclear on whether I'm missing something about how composer works, or https://github.com/wp-cli/wp-cli-bundle/blob/v2.3.0/composer.json actually produces the expected result, because all dependencies are marked constrained via ^?

In which case I could create a documentation update PR.

[lkraav]

I think the solution is adding "prefer-stable": true key in my project's composer.json, then composer remove / require ... dance.

Now I have 2.3.0.

But would be nice to have a confirmation, so I'd know what to write in documentation update.

[schlessera]

Yes, in general, you should always use "prefer-stable": true for your projects, unless you need to use development versions.

What you are telling Composer with the version constraint ~2.3.0 is that you want to use a minimum version of 2.3.0 without semantic breakage. So it will give you the latest version that is below 3.0.0. If you use "prefer-stable": true, it will use the latest stable version instead, giving you 2.3.0 until I release 2.4.0.

Of course you can also hardcode a specific version by omitting the tilde:

composer require wp-cli/wp-cli-bundle:2.3.0

It will then strictly keep to v2.3.0, even when updates are available.

This is not a bug, but the way semantic versioning with Composer works, so I'm closing the issue.