Compatibility Issue with Symfony/Config v7.0.0 in `getConfigTreeBuilder` Method about pdepend

[andrei-dascalu]

I'm not sure why PDepend 2.16.0 declares itself compatible with Symfony/Config v7 (as per its composer.json) if this method declaration clearly doesn't match what's in v7.

[kylekatarnls]

It's now fixed in master branch:

composer require "pdepend/pdepend:dev-master as 2.16.1" --dev

It will soon be released.

[olliescase]

This seems to have a proposed fix here: #696

Commenting so the issue and PR are connected

Currently I have tested this in my project (pdepend is required by phpmd for me) by adding the following to my composer json:

    "repositories": {
        "pdepend/pdepend": {
            "type": "package",
            "package": {
                "name": "pdepend/pdepend",
                "version": "2.16.1",
                "source": {
                    "type": "git",
                    "url": "https://github.com/symfonyaml/pdepend.git",
                    "reference": "patch-1"
                },
                "require": {
                    "php": ">=5.3.7",
                    "symfony/dependency-injection": "^2.3.0|^3|^4|^5|^6.0|^7.0",
                    "symfony/filesystem": "^2.3.0|^3|^4|^5|^6.0|^7.0",
                    "symfony/config": "^2.3.0|^3|^4|^5|^6.0|^7.0",
                    "symfony/polyfill-mbstring": "^1.19"
                },
                "require-dev": {
                    "phpunit/phpunit": "^4.8.36|^5.7.27",
                    "squizlabs/php_codesniffer": "^2.0.0",
                    "gregwar/rst": "^1.0",
                    "easy-doc/easy-doc": "0.0.0|^1.2.3"
                },
                "autoload": {
                    "psr-4": {
                        "PDepend\\": "src/main/php/PDepend"
                    }
                }
            },
            "comment": "TODO: Remove this once the next stable version of pdepend is released"
        },
    }

and then adding "phpdepend/phpdepend": "2.16.1", in the require section of the composer json.

[michaelarnauts]

I also notice this on PHP 8.3 8.2 after updating these packages:

• Upgrading composer/pcre (3.1.0 => 3.1.1): Extracting archive
• Upgrading symfony/filesystem (v6.3.1 => v7.0.0): Extracting archive
• Upgrading symfony/var-exporter (v6.3.4 => v7.0.0): Extracting archive
• Upgrading symfony/service-contracts (v3.3.0 => v3.4.0): Extracting archive
• Upgrading symfony/deprecation-contracts (v3.3.0 => v3.4.0): Extracting archive
• Upgrading symfony/dependency-injection (v6.3.5 => v7.0.0): Extracting archive
• Upgrading symfony/config (v6.3.2 => v7.0.0): Extracting archive
• Upgrading pdepend/pdepend (2.15.1 => 2.16.0): Extracting archive

EDIT: Sorry, I meant PHP 8.2

[georgesamy]

If you're on Symfony6 or less, don't update to 2.16 for now
In composer.json, I changed the requirement to "phpdepend/phpdepend": "2.15.*" , it's working for now

[kylekatarnls]

As you can see in this code snippet:

{
  "type": "git",
  "url": "https://github.com/symfonyaml/pdepend.git",
  "reference": "patch-1"
}

It's not taking pdepend from a trusted/stable source, the symfonyaml in this URL means it's provided by @symfonyaml who kindly worked on this fix (🙏), and patch-1 is the branch, this was a possible work-around, but as a general practice be careful about what you put in your dependencies, a branch can change, the owner can change the content at any time so better be sure to trust whoever you take a fork from, they can add some code to search credentials and send them to some endpoint, modify other dependencies etc.

I would strongly recommend to think twice before putting stuff like that in a composer.json that can end in production, and even in a dev/local machine it's a risk to consider.

Secondly, as soon as the namespace is not pdepend or phpmd, it's out of out team responsibility and no warranty can be provided by our team on those repositories.

Last, branch are by nature not meant to live forever, one should not assume it would be permanent nor rely on it.

If you are on Symfony 6, please just lock your PDepend version until we'll provide the proper fix:

composer require pdepend/pdepend:~2.15 --dev

[FikretCin]

[07-Dec-2023 10:57:30 UTC] PHP Fatal error: Declaration of PDepend\DependencyInjection\Configuration::getConfigTreeBuilder() must be compatible with Symfony\Component\Config\Definition\ConfigurationInterface::getConfigTreeBuilder(): Symfony\Component\Config\Definition\Builder\TreeBuilder in .../vendor/pdepend/pdepend/src/main/php/PDepend/DependencyInjection/Configuration.php on line 77

is that solved ?

[leodisarli]

Thanks @olliescase, i'll use the workaround until waiting the proper fix.
Cheers!

[leodisarli]

This seems to have a proposed fix here: #696

Commenting so the issue and PR are connected

Currently I have tested this in my project (pdepend is required by phpmd for me) by adding the following to my composer json:

    "repositories": {
        "pdepend/pdepend": {
            "type": "package",
            "package": {
                "name": "pdepend/pdepend",
                "version": "2.16.1",
                "source": {
                    "type": "git",
                    "url": "https://github.com/symfonyaml/pdepend.git",
                    "reference": "patch-1"
                },
                "require": {
                    "php": ">=5.3.7",
                    "symfony/dependency-injection": "^2.3.0|^3|^4|^5|^6.0|^7.0",
                    "symfony/filesystem": "^2.3.0|^3|^4|^5|^6.0|^7.0",
                    "symfony/config": "^2.3.0|^3|^4|^5|^6.0|^7.0",
                    "symfony/polyfill-mbstring": "^1.19"
                },
                "require-dev": {
                    "phpunit/phpunit": "^4.8.36|^5.7.27",
                    "squizlabs/php_codesniffer": "^2.0.0",
                    "gregwar/rst": "^1.0",
                    "easy-doc/easy-doc": "0.0.0|^1.2.3"
                },
                "autoload": {
                    "psr-4": {
                        "PDepend\\": "src/main/php/PDepend"
                    }
                }
            },
            "comment": "TODO: Remove this once the next stable version of pdepend is released"
        },
    }

and then adding "phpdepend/phpdepend": "2.16.1", in the require section of the composer json.

Ohhh they removed the branch, 👎 making this workaroud not possible anymore.

[AJenbo]

The issue will be closed when it is