laminas / laminas-dependency-plugin

Replace zendframework and zfcampus packages with their Laminas Project equivalents.

laminas-dependency-plugin

This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Steering Committee. If you have a security issue, please follow our security reporting guidelines. If you wish to take on the role of maintainer, please nominate yourself

🇷🇺 Русским гражданам

Мы, участники Laminas, родились и живем в разных странах. У многих из нас есть друзья, родственники и коллеги как в России, так и в Украине. Некоторые из нас родились в России. Некоторые из нас живут в России. У некоторых бабушки и дедушки сражались с фашистами во Второй мировой войне. Здесь никто не поддерживает фашизм.

У одного из нас есть украинская родственница, которая спаслась из дома вместе с сыном. Поезд задержался из-за бомбежки на дороге впереди. У нас есть друзья, которые прячутся в бомбоубежищах. Мы с тревогой ждем весточки от них после воздушных налетов, которые беспорядочно наносят удары и попадают по больницам, школам, детским садам и домам. Мы не берем это из каких-либо СМИ. Мы наблюдаем это напрямую.

Вы доверяете нам достаточно, чтоб использовать наши программы, и мы просим вас довериться нам вновь. Мы нуждаемся в помощи. Выходите и протестуйте против этой бесполезной войны. Остановите кровопролитие. Скажите "Нет войне!"

🇺🇸 To Citizens of Russia

We at Laminas come from all over the world. Many of us have friends, family and colleagues in both Russia and Ukraine. Some of us were born in Russia. Some of us currently live in Russia. Some have grandparents who fought Nazis in World War II. Nobody here supports fascism.

One team member has a Ukrainian relative who fled her home with her son. The train was delayed due to bombing on the road ahead. We have friends who are hiding in bomb shelters. We anxiously follow up on them after the air raids, which indiscriminately fire at hospitals, schools, kindergartens and houses. We're not taking this from any media. These are our actual experiences.

You trust us enough to use our software. We ask that you trust us to say the truth on this. We need your help. Go out and protest this unnecessary war. Stop the bloodshed. Say "stop the war!"

This Composer plugin, when enabled in a project, intercepts requests to install packages from the zendframework and zfcampus vendors, and will replace them with the equivalents from the Laminas Project.

Installation

$ composer require laminas/laminas-dependency-plugin

Composer version

This package only works with Composer versions prior to 2.3; we recommend using the 2.2 LTS version. The Composer download documentation details how to select the 2.2 LTS:

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('sha384', 'composer-setup.php') === '55ce33d7678c5a611085589f1f3ddf8b3c52d662cd01d4ba75c0ee0459970c2200a51f492d557530c71c15d8dba01eae') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
php composer-setup.php --2.2

If you are on a later version of Composer, you can choose to rollback to the LTS version using the self-update command:

composer self-update --2.2

laminas-dependency-plugin's Issues

Adds support for Composer v2

Feature Request

Q	A
New Feature	yes
BC Break	maybe ?

Summary

Composer v2 is behind the corner and we should be ready on the day 0, so we need updte this library ASAP.

This PR might be helpful:
Ocramius/PackageVersions#133

Psalm integration

Feature Request

Q	A
QA	yes

Summary

As decided during the Technical-Steering-Committee Meeting on August 3rd, 2020, Laminas wants to implement vimeo/psalm in all packages.

Implementing psalm is quite easy.

Required

• Create a psalm.xml in the project root
• Copy and paste the contents from this psalm.xml.dist
• Run $ composer require --dev vimeo/psalm
• Run $ vendor/bin/psalm --set-baseline=psalm-baseline.xml
• Add a composer script static-analysis with the command psalm --shepherd --stats
• Add a new line to script: in .travis.yml: - if [[ $TEST_COVERAGE == 'true' ]]; then composer static-analysis ; fi
• Remove phpstan from the project (phpstan.neon.dist, .travis.yml entry, composer.json require-dev and scripts)

Optional

• Fix as many psalm errors as possible.

v2.3.0 can't be installed with composer 2.3.0

De require voor de composer-plugin-api in v2.3.0 is more strict then it was in v2.2.0:

v2.2.0:

"composer-plugin-api": "^1.1 || ^2.0",

v2.3.0:

"composer-plugin-api": ">=1.1.0 <2.3.0",

This gives issues because v2.3.0 can't be installed. Could this be reverted, or, if there is a reason for this lock-in, could it be explained?

Missing exclusion zendframework/zend-debug

I'm using archived repo: zendframework/zend-debug.
The migration to Laminas was successful.

The first use of "composer update" worked fine.
When using "composer update" for the second time, the following message was displayed:

Your requirements could not be resolved to an installable set of packages.

Problem 1

• The requested package laminas/laminas-debug could not be found in any version, there may be a typo in the package name.

I think the DependencyRewriterPlugin::transformPackageName() function is missing the zendframework/zend-debug repository exclusion - similar to zendframework/zend-version (line 266).

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository problems

These problems occurred while renovating this repository. View logs.

• WARN: Use matchDepNames instead of matchPackageNames

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update dependency composer/composer to >=2.2.23 <2.3.0 [SECURITY]
• Update dependency psalm/plugin-phpunit to ^0.19.0
• Update dependency phpunit/phpunit to v11
• Update dependency vimeo/psalm to v5
• Lock file maintenance
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

composer

composer.json

• php ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0
• composer/composer >=1.9.0 <2.3.0
• laminas/laminas-coding-standard ~2.5.0
• mikey179/vfsstream ^1.6.11
• phpunit/phpunit ^9.5.5
• psalm/plugin-phpunit ^0.18.0
• vimeo/psalm ^4.5

github-actions

.github/workflows/continuous-integration.yml

.github/workflows/docs-build.yml

.github/workflows/release-on-milestone-closed.yml

---

• Check this box to trigger a request for Renovate to run again on this repository

Installation Fails on Missing File

Bug Report

Q	A
Self	2.1.2
OS	Ubuntu 20.04
PHP	7.4.3 (fpm/cli)
Composer	1.10.20

Summary

Installation of this plugin or any other package that relies on this fails with a No such file or directory error.

Current behavior

See Above.

How to reproduce

1. Create an empty directory
2. Create an empty composer.json
3. Add a requirement of laminas / laminas-dependency-plugin
4. Run composer install or composer update
5. The error mentioned above is produced.

Other Steps:
6. Add a requirement of another project that requires this - example: magento
7. Run composer install
8. Install fails on error mentioned above

Steps done to troubleshoot:

1. Composer v1 and v2, latest
2. Composer v1 at 1.10.10
3. Required as part of a larger project and in an empty directory by itself
4. Clear composer cache
5. Remove vendor folder
6. Remove composer.lock file

Expected behavior

Installation of package.

throws exception

Bug Report

Q	A
Version(s)	2.0.0beta1

Summary

composer check throws LogicException

Current behavior

composer check -vvv
Reading ./composer.json
Loading config file ./composer.json
Checked CA file /etc/ssl/certs/ca-certificates.crt: valid
Executing command (/var/www/html): git branch -a --no-color --no-abbrev -v
Executing command (/var/www/html): git rev-list master..feature-FB-213/composer-2.0
Failed to initialize global composer: Composer could not find the config file: /root/.composer/composer.json
To initialize a project, please create a composer.json file as described in the https://getcomposer.org/ "Getting Started" section
Reading /var/www/html/vendor/composer/installed.json
Loading plugin PackageVersions\Installer
Loading plugin Laminas\ComponentInstaller\ComponentInstaller
Loading plugin Laminas\DependencyPlugin\DependencyRewriterPluginDelegator
Activating Laminas\DependencyPlugin\DependencyRewriterV2
Running 2.0.2 (2020-10-25 23:03:59) with PHP 7.4.11 on Linux / 5.4.0-47-generic
> pre-command-run: Laminas\DependencyPlugin\DependencyRewriterPluginDelegator->onPreCommandRun
In Laminas\DependencyPlugin\DependencyRewriterV2::onPreCommandRun

                                                 
  [LogicException]                               
  A package can only be added to one repository  
                                                 

Exception trace:
 () at phar:///usr/local/bin/composer/src/Composer/Package/BasePackage.php:136
 Composer\Package\BasePackage->setRepository() at phar:///usr/local/bin/composer/src/Composer/Repository/ArrayRepository.php:194
 Composer\Repository\ArrayRepository->addPackage() at phar:///usr/local/bin/composer/src/Composer/Repository/ArrayRepository.php:41
 Composer\Repository\ArrayRepository->__construct() at phar:///usr/local/bin/composer/src/Composer/Repository/RootPackageRepository.php:28
 Composer\Repository\RootPackageRepository->__construct() at phar:///usr/local/bin/composer/src/Composer/Command/CheckPlatformReqsCommand.php:65
 Composer\Command\CheckPlatformReqsCommand->execute() at phar:///usr/local/bin/composer/vendor/symfony/console/Command/Command.php:245
 Symfony\Component\Console\Command\Command->run() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:835
 Symfony\Component\Console\Application->doRunCommand() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:185
 Symfony\Component\Console\Application->doRun() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:309
 Composer\Console\Application->doRun() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:117
 Symfony\Component\Console\Application->run() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:121
 Composer\Console\Application->run() at phar:///usr/local/bin/composer/bin/composer:63
 require() at /usr/local/bin/composer:24

check-platform-reqs [--no-dev]

or

composer why laminas/laminas-dependency-plugin -vvv
Reading ./composer.json
Loading config file ./composer.json
Checked CA file /etc/ssl/certs/ca-certificates.crt: valid
Executing command (/var/www/html): git branch -a --no-color --no-abbrev -v
Executing command (/var/www/html): git rev-list master..feature-FB-213/composer-2.0
Failed to initialize global composer: Composer could not find the config file: /root/.composer/composer.json
To initialize a project, please create a composer.json file as described in the https://getcomposer.org/ "Getting Started" section
Reading /var/www/html/vendor/composer/installed.json
Loading plugin PackageVersions\Installer
Loading plugin Laminas\ComponentInstaller\ComponentInstaller
Loading plugin Laminas\DependencyPlugin\DependencyRewriterPluginDelegator
Activating Laminas\DependencyPlugin\DependencyRewriterV2
Running 2.0.2 (2020-10-25 23:03:59) with PHP 7.4.11 on Linux / 5.4.0-47-generic
> pre-command-run: Laminas\DependencyPlugin\DependencyRewriterPluginDelegator->onPreCommandRun
In Laminas\DependencyPlugin\DependencyRewriterV2::onPreCommandRun

                                                 
  [LogicException]                               
  A package can only be added to one repository  
                                                 

Exception trace:
 () at phar:///usr/local/bin/composer/src/Composer/Package/BasePackage.php:136
 Composer\Package\BasePackage->setRepository() at phar:///usr/local/bin/composer/src/Composer/Repository/ArrayRepository.php:194
 Composer\Repository\ArrayRepository->addPackage() at phar:///usr/local/bin/composer/src/Composer/Repository/ArrayRepository.php:41
 Composer\Repository\ArrayRepository->__construct() at phar:///usr/local/bin/composer/src/Composer/Repository/RootPackageRepository.php:28
 Composer\Repository\RootPackageRepository->__construct() at phar:///usr/local/bin/composer/src/Composer/Command/BaseDependencyCommand.php:77
 Composer\Command\BaseDependencyCommand->doExecute() at phar:///usr/local/bin/composer/src/Composer/Command/DependsCommand.php:55
 Composer\Command\DependsCommand->execute() at phar:///usr/local/bin/composer/vendor/symfony/console/Command/Command.php:245
 Symfony\Component\Console\Command\Command->run() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:835
 Symfony\Component\Console\Application->doRunCommand() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:185
 Symfony\Component\Console\Application->doRun() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:309
 Composer\Console\Application->doRun() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:117
 Symfony\Component\Console\Application->run() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:121
 Composer\Console\Application->run() at phar:///usr/local/bin/composer/bin/composer:63
 require() at /usr/local/bin/composer:24

depends [-r|--recursive] [-t|--tree] [--] <package> [<constraint>]

I am not sure it is a composer bug or laminas-dependency-plugin

Getting "array_shift() expects parameter 1 to be array, boolean given" error on composer require

Bug Report

Q	A
Version(s)	1.0.1

Summary

Have a project with the dependency plugin installed, and when I try to run composer require laminas/laminas-db --dev I get an ErrorException:

[ErrorException]
array_shift() expects parameter 1 to be array, boolean given

Current behavior

Current behavior is above.

How to reproduce

Described above.

Expected behavior

Composer should install the laminas/laminas-db package.

Looking at the source, there appears to be a case where an assignment operator is used where a comparison operator should be used instead: https://github.com/laminas/laminas-dependency-plugin/blob/master/src/DependencyRewriterPlugin.php#L230

If I manually edit that file and change that assignment to a == comparison operator, the composer require command is successful.

Cannot Install With Latest Composer Version

Bug Report

I am using Composer Version 2.6.5 and encounter this issue when attempting to install latest version (2.6.0):
laminas/laminas-dependency-plugin 2.5.0 requires composer-plugin-api >=1.1.0 <2.3.0 -> found composer-plugin-api[2.6.0] but it does not match the constraint.

Q	A
Version(s)	^2.5.0

Summary

Current behavior

• Error is thrown, see above.
• Unable to install to latest versions.

How to reproduce

• While using a composer version of 2.3.0 or newer, run the following command:
• composer require laminas/laminas-dependency-plugin:^2.5

Expected behavior

• Package installs without issue.

Ignored platform requirements are not passed to lock update command

Bug Report

Q	A
Version(s)	2.1.0

Summary

In case, platform requirements are being ignored, the composer v2 plugin does not properly pass those arguments to the lock-Update command.

Current behavior

When executing composer update --prefer-lowest --prefer-stable --ignore-platform-req=php on PHP 8.0, it is most likely the case, that a version of a package is being installed which is not compatible with PHP 8.0.

As of the base functionality of the composer v2 plugin, we have to update the composer.lock after the command mentioned above has finished.

The composer update --lock command needs those Arguments which are used to ignore platform requirements aswell.

How to reproduce

https://travis-ci.com/github/laminas/laminas-servicemanager/jobs/456178037#L639

Expected behavior

Downgrade works and installs laminas/laminas-code v3.3.1 even tho it does not support PHP 8.0.

PHP 8.0 support

Feature Request

Q	A
New Feature	yes

Summary

To be prepared for the december release of PHP 8.0, this repository has some additional TODOs to be tested against the new major version.

In order to make this repository compatible, one has to follow these steps:

• Modify composer.json to provide support for PHP 8.0 by adding the constraint ~8.0.0
• Modify composer.json to drop support for PHP less than 7.3
• Modify composer.json to implement phpunit 9.3 which supports PHP 7.3+
• Modify .travis.yml to ignore platform requirements when installing composer dependencies (simply add --ignore-platform-reqs to COMPOSER_ARGS env variable)
• Modify .travis.yml to add PHP 8.0 to the matrix (NOTE: Do not allow failures as PHP 8.0 has a feature freeze since 2020-08-04!)
• Modify source code in case there are incompatibilities with PHP 8.0

Conflicts are not properly handled

Bug Report

Q	A
Version(s)	2.1.0

Summary

I am actually working on laminas/laminas-servicemanager and get code issues which were fixed with laminas-code 3.3.1.
The composer.json I am working with contains:

{
    "conflict": {
        "laminas/laminas-code": "<3.4.0"
    }
}

laminas/laminas-servicemanager#64

This should block the installation of the currently installed laminas/laminas-code 3.3.0.

Current behavior

laminas/laminas-code v3.3.0 is installed even tho it is conflicting with the composer.json of the project.
zendframework/zend-code is required by a 3rd-party dependency and rewritten by this plugin.

travis details

How to reproduce

composer update --prefer-lowest

More details following.

Expected behavior

Minimum version of laminas/laminas-code would be v3.4.0 as below is conflicting.

zendframework/zend-expressive-zend* packages handled wrong

Bug Report

Q	A
Version(s)	1.0.3

Summary

zendframework/zend-expressive-zendviewrenderer is changed to a wrong name mezzio/mezzio-zendviewrenderer. The changed name should be mezzio/mezzio-laminasviewrenderer

Current behavior

zendframework/zend-expressive-zendviewrenderer is changed to a wrong name mezzio/mezzio-zendviewrenderer.
I assume it will result in a wrong package name for any zendframework/zend-expressive-zend* packages. (like zend-expressive-zendrouter)

How to reproduce

Update a package which uses zendframework/zend-expressive-zendviewrenderer

Expected behavior

Should install mezzio/mezzio-laminasviewrenderer.

Installation with php8.3 and composer 2.6.6

Bug Report

Q	A
laminas/laminas-dependency-plugin	2.6.0

Summary

with composer install on php8.3 with composer 2.6.6, your package Laminas-dependency-plugin is locked :

Problem 1
- Root composer.json requires laminas/laminas-dependency-plugin ^2.6.0 -> satisfiable by laminas/laminas-dependency-plugin[2.6.0].
- laminas/laminas-dependency-plugin 2.6.0 requires composer-plugin-api >=1.1.0 <2.3.0 -> found composer-plugin-api[2.6.0] but it does not match the constraint.

How to reproduce

this is the require library in my composer.json:

"require": {
"php": "~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0",
"laminas/laminas-component-installer": "^3.4.0",
"laminas/laminas-mvc": "^3.7.0",
"laminas/laminas-development-mode": "^3.12.0",
"laminas/laminas-cache-storage-adapter-apcu": "^2.5",
"laminas/laminas-cache-storage-adapter-redis": "^2.7.0",
"laminas/laminas-cache-storage-adapter-memory": "^2.3.0",
"laminas/laminas-cache-storage-adapter-session": "^2.5.0",
"laminas/laminas-json-server": "^3.9.0",
"laminas/laminas-cli": "^1.10.0",
"laminas/laminas-mvc-i18n": "^1.2.0",
"laminas/laminas-mvc-plugins": "^1.2.0",
"laminas/laminas-psr7bridge": "^1.11.0",
"laminas/laminas-di": "^3.13.0",
"laminas/laminas-permissions-acl": "^2.16.0",
"laminas/laminas-dependency-plugin": "^2.6.0",
"laminas/laminas-cache-storage-deprecated-factory": "^1.2.0",
"laminas/laminas-servicemanager": "^3.22"
},

Expected behavior

we want install laminas/laminas-dependancy-plugin at the last version with the last version of php and composer.
Tks for this resolving

Dependency Rewrite does not work if packagist.org is not involved

Bug Report

Q	A
Version(s)	1.0.0

Summary

Gonna update this as the outdated part below this report was due to a misconfiguration of satis.

However, I've pointed out, that private packagists packages.json provides the information for lazy providers. Those lazy providers are not properly resolved by @composer.
Ive created a pull request in composer/composer#8516 which solves the issue in resolving package names for private packagist.

Current behavior

With {"packagist.org": false} in the repositories property of composer.json, the DependencyRewriterPlugin does not properly overwrite the package property in the install operation if an external repository provides a packages.json with a providers-lazy-url property.

How to reproduce

Only with private packagist on-premise installation. Therefore not possible to reproduce without that.

NOTE If you remove {"packagist.org": false}, the migration works as expected.

Expected behavior

laminas/laminas-escaper is being installed instead of zendframework/zend-escaper.

Outdated bug repot

Hey guys, as already talked about this on slack, I was finally able to reproduce the whole thing with satis.

I found out, that, if packagist.org is explicitly excluded in composer.json, something is wrong with the dependency resolver of composer (or at least it behaves different).

Actually, I did not found the issue in composer as I am not able to debug this without more insights which probably takes too long to achieve. Probably you guys already got some debugging stuff prepared somewhere or we can delegate this directly to @composer.

I prepared 2 repositories on github.
https://github.com/boesing/laminas-migration-base - mimics a project which has to get migrated (I already "executed" the migration script)
https://github.com/boesing/laminas-migration-testing - an "external" library which requires old zendframework packages

You can find a README.md with a step-by-step guide to reproduce the different behavior.

composer update with version 1 throws AssertionError

Bug Report

Q	A
Version(s)	2.0.0beta1

When using 2.0.0beta1 and issuing a composer update with version 1 of composer, it throws an AssertionError:

PHP Fatal error: Uncaught AssertionError: assert($rewriter instanceof DependencySolvingCapableInterface) in /mnt/e/PhpStormProjects/laminas/test-mvc-co2/vendor/laminas/laminas-dependency-plugin/src/DependencyRewriterPluginDelegator.php:69

It only occurs if the corresponding assert. settings in php.ini are active.

The execution itself works because DependencyRewriterV1 does implement the method onPreDependenciesSolving which DependencySolvingCapableInterface requires.

It seems, that adding implements DependencySolvingCapableInterface to DependencyRewriterV1 solves the error.

Upgrade to composer-plugin-api 2.0.0

In order to take advantage of composer 2.0 the version in composer.json needs to be bumped up.

Allow installation with current Composer versions (plugin API 2.6.0)

Feature Request

Q	A
New Feature	yes
RFC	no
BC Break	no (hopefully?)

Summary

Currently this package can only be installed with Composer versions <2.6.0 which bumped the Composer plugin API version to 2.6.0.
Versions prior to 2.3.0 of this package allowed ^2.0 of the composer-plugin-api, but only newer versions added support for PHP 8.2 and 8.3.
Hence, right now you cannot use this package with Composer >= 2.6.0 and PHP >= 8.2.