Page MenuHomePhabricator

Composer dependencies of MW 1.29.1 tarball broken
Closed, ResolvedPublic

Description

The composer.json in the 1.29.1 tarball requires "justinrainbow/json-schema": "~3.0", but the tarball contains version 5.2.
This breaks installation of all extensions and skins using composer (even if they don't depend on justinrainbow/json-schema themselves).

(Why the tarball contains require-dev dependencies at all is another question.)

See https://github.com/cmln/chameleon/issues/50 & https://github.com/cmln/chameleon/issues/54

Details

Related Gerrit Patches:

Event Timeline

Foxtrott created this task.Nov 9 2017, 3:35 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 9 2017, 3:35 PM
Reedy added a subscriber: Reedy.

(Why the tarball contains require-dev dependencies at all is another question.)

It's not in as a dev dependancy, it's in because the mediawiki-vendor repo used by Wikimedia has it for some other extensions that require it

See also T172927

Change 390270 had a related patch set uploaded (by Reedy; owner: Legoktm):
[mediawiki/core@REL1_29] Bump justinrainbow/json-schema development dependency to ~5.2

https://gerrit.wikimedia.org/r/390270

Reedy added a comment.Nov 9 2017, 4:11 PM

^ Patch above fixes the immediate issue, until we decide longer term how we're actually going to build vendor folders for tarball releases in future

Change 390270 merged by jenkins-bot:
[mediawiki/core@REL1_29] Bump justinrainbow/json-schema development dependency to ~5.2

https://gerrit.wikimedia.org/r/390270

Should we mark this as resolved and have the long term discussion on T172927: mediawiki/vendor is bloated for tarball releases?

Thanks for the quick fix!

@Kghbln FYI

I was wondering why suddenly people appear on the mailing-l with [0] and claiming that the setup from 1.28 to 1.29 is broken.

- The requested package justinrainbow/json-schema (installed at 5.2.0, required as ~3.0) is satisfiable by justinrainbow/json-schema[5.2.0] but these conflict with your requirements or minimum-stability.
  • Does 1.30 has the same issue?
  • When is a 1.29.2 patch release planned?
  • How can this be avoided in future?

[0] https://sourceforge.net/p/semediawiki/mailman/message/36080889/

  • Does 1.30 has the same issue?
  • When is a 1.29.2 patch release planned?
  • How can this be avoided in future?
  1. No. You could check this for yourself very easily - https://github.com/wikimedia/mediawiki/blob/REL1_30/composer.json#L56
  2. Very soon
  3. Try reading the task where T172927 is mentioned numerous times as a solution to both this and other composer/vendor related issues?

@Reedy Do you think your response in tone is appropriate? I don't think so!

No. You could check this for yourself very easily

A simple, no is sufficient, no need for a hyperbolic connotation as in " You could check this for yourself very easily..." because I know I could but between establishing a fact of "no"and me looking at the file are two different things.

Very soon

Means exactly what?

Try reading the task where T172927 is mentioned numerous times as a solution to both this and other composer/vendor related issues?

Again, on the matter of "Try reading the task .... mentioned numerous times", just link to the task which would be sufficient and doesn't carry an underlying tone of annoyance.

Legoktm closed this task as Resolved.Nov 11 2017, 5:19 PM
Legoktm assigned this task to Reedy.

No. You could check this for yourself very easily

A simple, no is sufficient, no need for a hyperbolic connotation as in " You could check this for yourself very easily..." because I know I could but between establishing a fact of "no"and me looking at the file are two different things.

I think you're reading too much into Reedy's comment. I'm fairly sure he just meant that as a "here's where I figured that out so in the future you can be self-sufficient".

Very soon

Means exactly what?

It means...exactly that. Sometimes "soon" is some euphemism for the long out future but in this case Reedy really means, very soon. A pre-announcement will be sent out shortly.

Anyways, closing this per my comment earlier, we can have the follow-up discussion on T172927: mediawiki/vendor is bloated for tarball releases.