Page MenuHomePhabricator
Create Task
Maniphest T296208

mediawiki composer complains about symfony/yaml version specification
Closed, ResolvedPublicBUG REPORT
Actions

Description

List of steps to reproduce (step by step, including full links if applicable):

  • Update to latest mediawiki dev version (git pull)
  • Run docker-compose exec mediawiki composer update

What happens?:
Composer complained that it found symfony/yaml 5.3.11 but 5.3.6 was specified (sorry I don't have the exact error message here).

What should have happened instead?:
5.3.11 presumably will work instead of 5.3.6? I modified the composer.json line to say "~5.3" instead of "5.3.6" and it worked as far as I could tell.

Software version (if not a Wikimedia wiki), browser information, screenshots, other information, etc:

Details

SubjectRepoBranchLines +/-
composer: Loosen symfony/yaml dependency due to bug in composer-merge-pluginmediawiki/extensions/WikiLambdamaster+1 -1
Customize query in gerrit

Event Timeline

ArthurPSmith created this task.Nov 22 2021, 6:29 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 22 2021, 6:29 PM
Jdforrester-WMF added a comment.Nov 22 2021, 6:37 PM

We are locked specifically to 5.3.6 because that's the version that passed security review; per https://libraryupgrader2.wmcloud.org/library/composer/symfony/yaml?branch=main there are a few other users in devdeps and deps but none that should hard-conflict. Did you manually add the dependency, or did you use a composer.local.json file?

DVrandecic subscribed.Nov 22 2021, 10:31 PM

I had the same issue when I created a fresh install. Here's what I did:

git clone --recurse-submodules --remote-submodules https://gerrit.wikimedia.org/r/mediawiki/extensions/WikiLambda extensions/WikiLambda
echo '{
  "extra": {
    "merge-plugin": {
      "include": [
        "extensions/WikiLambda/composer.json"
      ]
    }
  }
}' > composer.local.json
docker-compose exec mediawiki composer update

And here's the error message:

> ComposerHookHandler::onPreUpdate
Loading composer repositories with package information
Updating dependencies
Unable to find a compatible set of packages based on your non-dev requirements alone.
Your requirements can be resolved successfully when require-dev packages are present.
You may need to move packages from require-dev or some of their dependencies to require.

  Problem 1
    - Root composer.json requires symfony/yaml 5.3.6, found symfony/yaml[v5.3.11] but it does not match the constraint.
ArthurPSmith added a comment.Nov 23 2021, 2:22 PM
In T296208#7521080, @Jdforrester-WMF wrote:

We are locked specifically to 5.3.6 because that's the version that passed security review; per https://libraryupgrader2.wmcloud.org/library/composer/symfony/yaml?branch=main there are a few other users in devdeps and deps but none that should hard-conflict. Did you manually add the dependency, or did you use a composer.local.json file?

I'm not quite sure what you're asking, but I have composer.local.json in my mediawiki top-level directory, with the contents:

{
  "extra": {
    "merge-plugin": {
      "include": [
        "extensions/WikiLambda/composer.json"
      ]
    }
  }
}
DVrandecic added a comment.Nov 24 2021, 2:30 AM

I did as James suggested:

rm -rf vendor
rm composer.lock
docker-compose exec mediawiki composer update

I get the following output:

> ComposerHookHandler::onPreUpdate
Loading composer repositories with package information
Updating dependencies
Lock file operations: 125 installs, 0 updates, 0 removals
  - Locking composer/semver (3.2.5)
  - Locking composer/spdx-licenses (1.5.5)
  - Locking composer/xdebug-handler (2.0.2)
  - Locking cssjanus/cssjanus (v2.1.0)
  - Locking doctrine/cache (2.1.1)
  - Locking doctrine/dbal (2.13.4)
  - Locking doctrine/deprecations (v0.5.3)
  - Locking doctrine/event-manager (1.1.1)
  - Locking doctrine/instantiator (1.4.0)
  - Locking doctrine/sql-formatter (1.1.1)
  - Locking felixfbecker/advanced-json-rpc (v3.2.1)
  - Locking giorgiosironi/eris (0.10.0)
  - Locking guzzlehttp/guzzle (7.4.0)
  - Locking guzzlehttp/promises (1.5.1)
  - Locking guzzlehttp/psr7 (2.1.0)
  - Locking hamcrest/hamcrest-php (v2.0.1)
  - Locking johnkary/phpunit-speedtrap (v3.3.0)
  - Locking justinrainbow/json-schema (5.2.11)
  - Locking liuggio/statsd-php-client (v1.0.18)
  - Locking mediawiki/mediawiki-codesniffer (v38.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.11.0)
  - Locking mediawiki/phan-taint-check-plugin (3.3.2)
  - Locking microsoft/tolerant-php-parser (v0.1.1)
  - Locking monolog/monolog (2.2.0)
  - Locking myclabs/deep-copy (1.10.2)
  - Locking netresearch/jsonmapper (v4.0.0)
  - Locking nikic/php-parser (v4.13.1)
  - Locking nmred/kafka-php (v0.1.5)
  - Locking oojs/oojs-ui (v0.42.1)
  - Locking pear/console_getopt (v1.4.3)
  - Locking pear/mail (v1.4.1)
  - Locking pear/mail_mime (1.10.11)
  - Locking pear/net_smtp (1.10.0)
  - Locking pear/net_socket (v1.2.2)
  - Locking pear/net_url2 (v2.2.2)
  - Locking pear/pear-core-minimal (v1.10.11)
  - Locking pear/pear_exception (v1.0.2)
  - Locking phan/phan (5.2.0)
  - Locking phar-io/manifest (2.0.3)
  - Locking phar-io/version (3.1.0)
  - Locking php-parallel-lint/php-console-color (v0.3)
  - Locking php-parallel-lint/php-console-highlighter (v0.5)
  - Locking php-parallel-lint/php-parallel-lint (v1.3.1)
  - Locking phpdocumentor/reflection-common (2.2.0)
  - Locking phpdocumentor/reflection-docblock (5.3.0)
  - Locking phpdocumentor/type-resolver (1.5.1)
  - Locking phpspec/prophecy (1.14.0)
  - Locking phpunit/php-code-coverage (7.0.15)
  - Locking phpunit/php-file-iterator (2.0.4)
  - Locking phpunit/php-text-template (1.2.1)
  - Locking phpunit/php-timer (2.1.3)
  - Locking phpunit/php-token-stream (3.1.3)
  - Locking phpunit/phpunit (8.5.21)
  - Locking pleonasm/bloom-filter (1.0.2)
  - Locking psr/container (1.1.1)
  - Locking psr/http-client (1.0.1)
  - Locking psr/http-factory (1.0.1)
  - Locking psr/http-message (1.0.1)
  - Locking psr/log (1.1.4)
  - Locking psy/psysh (v0.10.11)
  - Locking ralouphie/getallheaders (3.0.3)
  - Locking sabre/event (5.1.4)
  - Locking sebastian/code-unit-reverse-lookup (1.0.2)
  - Locking sebastian/comparator (3.0.3)
  - Locking sebastian/diff (3.0.3)
  - Locking sebastian/environment (4.2.4)
  - Locking sebastian/exporter (3.1.4)
  - Locking sebastian/global-state (3.0.1)
  - Locking sebastian/object-enumerator (3.0.4)
  - Locking sebastian/object-reflector (1.1.2)
  - Locking sebastian/recursion-context (3.0.1)
  - Locking sebastian/resource-operations (2.0.2)
  - Locking sebastian/type (1.1.4)
  - Locking sebastian/version (2.0.1)
  - Locking seld/jsonlint (1.8.3)
  - Locking squizlabs/php_codesniffer (3.6.1)
  - Locking symfony/console (v5.3.11)
  - Locking symfony/deprecation-contracts (v2.5.0)
  - Locking symfony/polyfill-intl-grapheme (v1.23.1)
  - Locking symfony/polyfill-intl-normalizer (v1.23.0)
  - Locking symfony/polyfill-php73 (v1.23.0)
  - Locking symfony/polyfill-php80 (v1.23.1)
  - Locking symfony/service-contracts (v2.5.0)
  - Locking symfony/string (v5.3.10)
  - Locking symfony/var-dumper (v5.3.11)
  - Locking symfony/yaml (v5.3.11)
  - Locking theseer/tokenizer (1.2.1)
  - Locking tysonandre/var_representation_polyfill (0.1.1)
  - Locking webmozart/assert (1.10.0)
  - Locking wikimedia/assert (v0.5.0)
  - Locking wikimedia/at-ease (v2.1.0)
  - Locking wikimedia/base-convert (v2.0.1)
  - Locking wikimedia/cdb (1.4.1)
  - Locking wikimedia/cldr-plural-rule-parser (v2.0.0)
  - Locking wikimedia/common-passwords (v0.3.0)
  - Locking wikimedia/composer-merge-plugin (v2.0.1)
  - Locking wikimedia/dodo (v0.4.0)
  - Locking wikimedia/html-formatter (3.0.1)
  - Locking wikimedia/idle-dom (v0.10.0)
  - Locking wikimedia/ip-set (3.0.0)
  - Locking wikimedia/ip-utils (3.0.2)
  - Locking wikimedia/less.php (v3.1.0)
  - Locking wikimedia/minify (2.2.6)
  - Locking wikimedia/normalized-exception (v1.0.1)
  - Locking wikimedia/object-factory (v3.0.2)
  - Locking wikimedia/parsoid (v0.15.0-a10)
  - Locking wikimedia/php-session-serializer (v2.0.0)
  - Locking wikimedia/purtle (v1.0.8)
  - Locking wikimedia/relpath (3.0.0)
  - Locking wikimedia/remex-html (3.0.1)
  - Locking wikimedia/request-timeout (1.1.0)
  - Locking wikimedia/running-stat (v1.2.1)
  - Locking wikimedia/scoped-callback (v3.0.0)
  - Locking wikimedia/services (2.0.1)
  - Locking wikimedia/shellbox (3.0.0)
  - Locking wikimedia/testing-access-wrapper (2.0.0)
  - Locking wikimedia/timestamp (v3.0.0)
  - Locking wikimedia/utfnormal (3.0.2)
  - Locking wikimedia/wait-condition-loop (v2.0.2)
  - Locking wikimedia/wikipeg (2.0.6)
  - Locking wikimedia/wrappedstring (v4.0.1)
  - Locking wikimedia/xmp-reader (0.8.1)
  - Locking wikimedia/zest-css (2.0.2)
  - Locking wmde/hamcrest-html-matchers (v1.0.0)
  - Locking zordius/lightncandy (v1.2.6)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 125 installs, 0 updates, 0 removals
  - Installing wikimedia/composer-merge-plugin (v2.0.1): Extracting archive
  - Installing cssjanus/cssjanus (v2.1.0): Extracting archive
  - Installing doctrine/event-manager (1.1.1): Extracting archive
  - Installing doctrine/deprecations (v0.5.3): Extracting archive
  - Installing doctrine/cache (2.1.1): Extracting archive
  - Installing doctrine/dbal (2.13.4): Extracting archive
  - Installing doctrine/sql-formatter (1.1.1): Extracting archive
  - Installing giorgiosironi/eris (0.10.0): Extracting archive
  - Installing guzzlehttp/promises (1.5.1): Extracting archive
  - Installing ralouphie/getallheaders (3.0.3): Extracting archive
  - Installing psr/http-message (1.0.1): Extracting archive
  - Installing psr/http-factory (1.0.1): Extracting archive
  - Installing guzzlehttp/psr7 (2.1.0): Extracting archive
  - Installing sebastian/version (2.0.1): Extracting archive
  - Installing sebastian/type (1.1.4): Extracting archive
  - Installing sebastian/resource-operations (2.0.2): Extracting archive
  - Installing sebastian/recursion-context (3.0.1): Extracting archive
  - Installing sebastian/object-reflector (1.1.2): Extracting archive
  - Installing sebastian/object-enumerator (3.0.4): Extracting archive
  - Installing sebastian/global-state (3.0.1): Extracting archive
  - Installing sebastian/exporter (3.1.4): Extracting archive
  - Installing sebastian/environment (4.2.4): Extracting archive
  - Installing sebastian/diff (3.0.3): Extracting archive
  - Installing sebastian/comparator (3.0.3): Extracting archive
  - Installing phpunit/php-timer (2.1.3): Extracting archive
  - Installing phpunit/php-text-template (1.2.1): Extracting archive
  - Installing phpunit/php-file-iterator (2.0.4): Extracting archive
  - Installing theseer/tokenizer (1.2.1): Extracting archive
  - Installing sebastian/code-unit-reverse-lookup (1.0.2): Extracting archive
  - Installing phpunit/php-token-stream (3.1.3): Extracting archive
  - Installing phpunit/php-code-coverage (7.0.15): Extracting archive
  - Installing webmozart/assert (1.10.0): Extracting archive
  - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
  - Installing phpdocumentor/type-resolver (1.5.1): Extracting archive
  - Installing phpdocumentor/reflection-docblock (5.3.0): Extracting archive
  - Installing doctrine/instantiator (1.4.0): Extracting archive
  - Installing phpspec/prophecy (1.14.0): Extracting archive
  - Installing phar-io/version (3.1.0): Extracting archive
  - Installing phar-io/manifest (2.0.3): Extracting archive
  - Installing myclabs/deep-copy (1.10.2): Extracting archive
  - Installing phpunit/phpunit (8.5.21): Extracting archive
  - Installing johnkary/phpunit-speedtrap (v3.3.0): Extracting archive
  - Installing justinrainbow/json-schema (5.2.11): Extracting archive
  - Installing squizlabs/php_codesniffer (3.6.1): Extracting archive
  - Installing composer/spdx-licenses (1.5.5): Extracting archive
  - Installing composer/semver (3.2.5): Extracting archive
  - Installing mediawiki/mediawiki-codesniffer (v38.0.0): Extracting archive
  - Installing tysonandre/var_representation_polyfill (0.1.1): Extracting archive
  - Installing symfony/polyfill-php80 (v1.23.1): Extracting archive
  - Installing symfony/polyfill-intl-normalizer (v1.23.0): Extracting archive
  - Installing symfony/polyfill-intl-grapheme (v1.23.1): Extracting archive
  - Installing symfony/string (v5.3.10): Extracting archive
  - Installing symfony/deprecation-contracts (v2.5.0): Extracting archive
  - Installing psr/container (1.1.1): Extracting archive
  - Installing symfony/service-contracts (v2.5.0): Extracting archive
  - Installing symfony/polyfill-php73 (v1.23.0): Extracting archive
  - Installing symfony/console (v5.3.11): Extracting archive
  - Installing sabre/event (5.1.4): Extracting archive
  - Installing netresearch/jsonmapper (v4.0.0): Extracting archive
  - Installing microsoft/tolerant-php-parser (v0.1.1): Extracting archive
  - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
  - Installing psr/log (1.1.4): Extracting archive
  - Installing composer/xdebug-handler (2.0.2): Extracting archive
  - Installing phan/phan (5.2.0): Extracting archive
  - Installing mediawiki/phan-taint-check-plugin (3.3.2): Extracting archive
  - Installing mediawiki/mediawiki-phan-config (0.11.0): Extracting archive
  - Installing nmred/kafka-php (v0.1.5): Extracting archive
  - Installing oojs/oojs-ui (v0.42.1): Extracting archive
  - Installing pear/pear_exception (v1.0.2): Extracting archive
  - Installing pear/console_getopt (v1.4.3): Extracting archive
  - Installing pear/pear-core-minimal (v1.10.11): Extracting archive
  - Installing pear/mail (v1.4.1): Extracting archive
  - Installing pear/mail_mime (1.10.11): Extracting archive
  - Installing pear/net_socket (v1.2.2): Extracting archive
  - Installing pear/net_smtp (1.10.0): Extracting archive
  - Installing php-parallel-lint/php-console-color (v0.3): Extracting archive
  - Installing php-parallel-lint/php-console-highlighter (v0.5): Extracting archive
  - Installing php-parallel-lint/php-parallel-lint (v1.3.1): Extracting archive
  - Installing psr/http-client (1.0.1): Extracting archive
  - Installing symfony/var-dumper (v5.3.11): Extracting archive
  - Installing nikic/php-parser (v4.13.1): Extracting archive
  - Installing psy/psysh (v0.10.11): Extracting archive
  - Installing seld/jsonlint (1.8.3): Extracting archive
  - Installing symfony/yaml (v5.3.11): Extracting archive
  - Installing wikimedia/base-convert (v2.0.1): Extracting archive
  - Installing wikimedia/cdb (1.4.1): Extracting archive
  - Installing wikimedia/cldr-plural-rule-parser (v2.0.0): Extracting archive
  - Installing pleonasm/bloom-filter (1.0.2): Extracting archive
  - Installing wikimedia/common-passwords (v0.3.0): Extracting archive
  - Installing wikimedia/html-formatter (3.0.1): Extracting archive
  - Installing wikimedia/idle-dom (v0.10.0): Extracting archive
  - Installing wikimedia/at-ease (v2.1.0): Extracting archive
  - Installing wikimedia/ip-set (3.0.0): Extracting archive
  - Installing wikimedia/less.php (v3.1.0): Extracting archive
  - Installing pear/net_url2 (v2.2.2): Extracting archive
  - Installing wikimedia/minify (2.2.6): Extracting archive
  - Installing wikimedia/normalized-exception (v1.0.1): Extracting archive
  - Installing wikimedia/zest-css (2.0.2): Extracting archive
  - Installing wikimedia/wikipeg (2.0.6): Extracting archive
  - Installing wikimedia/scoped-callback (v3.0.0): Extracting archive
  - Installing wikimedia/utfnormal (3.0.2): Extracting archive
  - Installing wikimedia/remex-html (3.0.1): Extracting archive
  - Installing wikimedia/object-factory (v3.0.2): Extracting archive
  - Installing wikimedia/ip-utils (3.0.2): Extracting archive
  - Installing wikimedia/dodo (v0.4.0): Extracting archive
  - Installing wikimedia/assert (v0.5.0): Extracting archive
  - Installing liuggio/statsd-php-client (v1.0.18): Extracting archive
  - Installing wikimedia/parsoid (v0.15.0-a10): Extracting archive
  - Installing wikimedia/php-session-serializer (v2.0.0): Extracting archive
  - Installing wikimedia/purtle (v1.0.8): Extracting archive
  - Installing wikimedia/relpath (3.0.0): Extracting archive
  - Installing wikimedia/request-timeout (1.1.0): Extracting archive
  - Installing wikimedia/running-stat (v1.2.1): Extracting archive
  - Installing wikimedia/services (2.0.1): Extracting archive
  - Installing monolog/monolog (2.2.0): Extracting archive
  - Installing guzzlehttp/guzzle (7.4.0): Extracting archive
  - Installing wikimedia/shellbox (3.0.0): Extracting archive
  - Installing wikimedia/testing-access-wrapper (2.0.0): Extracting archive
  - Installing wikimedia/wait-condition-loop (v2.0.2): Extracting archive
  - Installing wikimedia/wrappedstring (v4.0.1): Extracting archive
  - Installing wikimedia/timestamp (v3.0.0): Extracting archive
  - Installing wikimedia/xmp-reader (0.8.1): Extracting archive
  - Installing hamcrest/hamcrest-php (v2.0.1): Extracting archive
  - Installing wmde/hamcrest-html-matchers (v1.0.0): Extracting archive
  - Installing zordius/lightncandy (v1.2.6): Extracting archive
29 package suggestions were added by new dependencies, use `composer suggest` to see details.
Package phpunit/php-token-stream is abandoned, you should avoid using it. No replacement was suggested.
Package sebastian/resource-operations is abandoned, you should avoid using it. No replacement was suggested.
Generating optimized autoload files
40 packages you are using are looking for funding.
Use the `composer fund` command to find out more!

Running composer update to apply merge settings
> ComposerHookHandler::onPreUpdate
Loading composer repositories with package information
Updating dependencies
Unable to find a compatible set of packages based on your non-dev requirements alone.
Your requirements can be resolved successfully when require-dev packages are present.
You may need to move packages from require-dev or some of their dependencies to require.

  Problem 1
    - Root composer.json requires symfony/yaml 5.3.6, found symfony/yaml[v5.3.11] but it does not match the constraint.


Update to apply merge settings failed, reverting ./composer.lock to its original content.
> ComposerVendorHtaccessCreator::onEvent

I created the same composer.local.json as Arthur describes in the previous comment, other than that both composer.json and extensions/WikiLambda/composer.json are unchanged.

DVrandecic added a comment.Nov 24 2021, 3:11 AM

Even when I start a completely fresh install, this issue happens.

So here is what I did:

git clone --depth=1 https://gerrit.wikimedia.org/r/mediawiki/core.git mediawiki
cd mediawiki
echo "MW_SCRIPT_PATH=/w
MW_SERVER=http://localhost:8080
MW_DOCKER_PORT=8080
MEDIAWIKI_USER=Admin
MEDIAWIKI_PASSWORD=dockerpass
XDEBUG_CONFIG=
XDEBUG_ENABLE=true
XHPROF_ENABLE=true" >> .env
echo "version: '3.7'
services:
  mediawiki:
    # Linux users only: this extra_hosts section is necessary for Xdebug:
    extra_hosts:
      - \"host.docker.internal:host-gateway\"" > docker-compose.override.ym
echo "MW_DOCKER_UID=$(id -u)
MW_DOCKER_GID=$(id -g)" >> .env
git clone https://gerrit.wikimedia.org/r/mediawiki/skins/Vector skins/Vector
echo "wfLoadSkin( 'Vector' );" >> LocalSettings.php
git clone --recurse-submodules --remote-submodules https://gerrit.wikimedia.org/r/mediawiki/extensions/WikiLambda extensions/WikiLambda
echo '{
  "extra": {
    "merge-plugin": {
      "include": [
        "extensions/WikiLambda/composer.json"
      ]
    }
  }
}' > composer.local.json
docker-compose up -d
docker-compose exec mediawiki composer update

Leads to

Root composer.json requires symfony/yaml 5.3.6, found symfony/yaml[v5.3.11] but it does not match the constraint.
Reedy subscribed.Nov 24 2021, 3:20 AM

This looks like a bug with the merge plugin and the handling of the contents of the composer.local.json file...

MW core has in require-dev "symfony/yaml": "~3.4|~5.1",

WikiLambda has "symfony/yaml": "5.3.6" in require.

~5.1 would be satisified by 5.3.6

$ composer update --verbose
> init: Wikimedia\Composer\Merge\V2\MergePlugin->onInit
  [merge-plugin] Loading composer.local.json...
  [merge-plugin] Loading extensions/AntiSpoof/composer.json...
  [merge-plugin] Adding wikimedia/equivset
  [merge-plugin] Loading extensions/Flow/composer.json...
  [merge-plugin] Adding pimple/pimple
  [merge-plugin] Loading extensions/OAuth/composer.json...
  [merge-plugin] Prepending git repository
  [merge-plugin] Adding firebase/php-jwt
  [merge-plugin] Adding league/oauth2-server
  [merge-plugin] Loading extensions/OATHAuth/composer.json...
  [merge-plugin] Adding christian-riesen/base32
  [merge-plugin] Adding jakobo/hotp-php
  [merge-plugin] Loading extensions/TemplateStyles/composer.json...
  [merge-plugin] Adding wikimedia/css-sanitizer
  [merge-plugin] Loading extensions/WebAuthn/composer.json...
  [merge-plugin] Adding web-auth/webauthn-lib
  [merge-plugin] Loading extensions/WikiLambda/composer.json...
  [merge-plugin] Adding opis/json-schema
  [merge-plugin] Adding symfony/yaml
> pre-update-cmd: Wikimedia\Composer\Merge\V2\MergePlugin->onInstallUpdateOrDump
> pre-update-cmd: ComposerHookHandler::onPreUpdate
Loading composer repositories with package information
Updating dependencies                                               
Dependency resolution completed in 0.040 seconds
Analyzed 2256 packages to resolve dependencies
Analyzed 68587 rules to resolve dependencies
Dependency resolution completed in 0.000 seconds
Unable to find a compatible set of packages based on your non-dev requirements alone.
Your requirements can be resolved successfully when require-dev packages are present.
You may need to move packages from require-dev or some of their dependencies to require.

  Problem 1
    - Root composer.json requires symfony/yaml 5.3.6, found symfony/yaml[v5.3.11] but it does not match the constraint.

The simplest short term workaround is probably to just relax the constraint in WikiLambda's composer.json, and forking it into a seperate bug for the merge-plugin.

Jdforrester-WMF added a comment.Nov 24 2021, 10:03 AM
In T296208#7525497, @Reedy wrote:

This looks like a bug with the merge plugin and the handling of the contents of the composer.local.json file...

MW core has in require-dev "symfony/yaml": "~3.4|~5.1",

WikiLambda has "symfony/yaml": "5.3.6" in require.

~5.1 would be satisified by 5.3.6

$ composer update --verbose
> init: Wikimedia\Composer\Merge\V2\MergePlugin->onInit
  [merge-plugin] Loading composer.local.json...
  [merge-plugin] Loading extensions/AntiSpoof/composer.json...
  [merge-plugin] Adding wikimedia/equivset
  [merge-plugin] Loading extensions/Flow/composer.json...
  [merge-plugin] Adding pimple/pimple
  [merge-plugin] Loading extensions/OAuth/composer.json...
  [merge-plugin] Prepending git repository
  [merge-plugin] Adding firebase/php-jwt
  [merge-plugin] Adding league/oauth2-server
  [merge-plugin] Loading extensions/OATHAuth/composer.json...
  [merge-plugin] Adding christian-riesen/base32
  [merge-plugin] Adding jakobo/hotp-php
  [merge-plugin] Loading extensions/TemplateStyles/composer.json...
  [merge-plugin] Adding wikimedia/css-sanitizer
  [merge-plugin] Loading extensions/WebAuthn/composer.json...
  [merge-plugin] Adding web-auth/webauthn-lib
  [merge-plugin] Loading extensions/WikiLambda/composer.json...
  [merge-plugin] Adding opis/json-schema
  [merge-plugin] Adding symfony/yaml
> pre-update-cmd: Wikimedia\Composer\Merge\V2\MergePlugin->onInstallUpdateOrDump
> pre-update-cmd: ComposerHookHandler::onPreUpdate
Loading composer repositories with package information
Updating dependencies                                               
Dependency resolution completed in 0.040 seconds
Analyzed 2256 packages to resolve dependencies
Analyzed 68587 rules to resolve dependencies
Dependency resolution completed in 0.000 seconds
Unable to find a compatible set of packages based on your non-dev requirements alone.
Your requirements can be resolved successfully when require-dev packages are present.
You may need to move packages from require-dev or some of their dependencies to require.

  Problem 1
    - Root composer.json requires symfony/yaml 5.3.6, found symfony/yaml[v5.3.11] but it does not match the constraint.

The simplest short term workaround is probably to just relax the constraint in WikiLambda's composer.json, and forking it into a seperate bug for the merge-plugin.

Yeah, will file. :-( Thanks for confirming; I thought I was going mad.

gerritbot added a comment.Nov 24 2021, 10:05 AM

Change 741098 had a related patch set uploaded (by Jforrester; author: Jforrester):

[mediawiki/extensions/WikiLambda@master] composer: Loosen symfony/yaml dependency due to bug in composer-merge-plugin

https://gerrit.wikimedia.org/r/741098

gerritbot added a project: Patch-For-Review.Nov 24 2021, 10:05 AM
Jdforrester-WMF added a comment.Nov 24 2021, 10:14 AM

Filed upstream as https://github.com/wikimedia/composer-merge-plugin/issues/222

gerritbot added a comment.Nov 24 2021, 10:16 AM

Change 741098 merged by Jforrester:

[mediawiki/extensions/WikiLambda@master] composer: Loosen symfony/yaml dependency due to bug in composer-merge-plugin

https://gerrit.wikimedia.org/r/741098

Jdforrester-WMF claimed this task.Nov 24 2021, 10:16 AM
Jdforrester-WMF moved this task from Incoming to QA / Ready to close on the Abstract Wikipedia team (Phase η – Generic types) board.
ReleaseTaggerBot added a project: MW-1.38-notes (1.38.0-wmf.12; 2021-12-06).Nov 24 2021, 11:00 AM
Maintenance_bot removed a project: Patch-For-Review.Nov 24 2021, 11:10 AM
Jdforrester-WMF closed this task as Resolved.Nov 24 2021, 5:40 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits