Page MenuHomePhabricator

Mediawiki/includes/http not compatible with psr/http-message version 1.1
Closed, InvalidPublicBUG REPORT

Assigned To
None
Authored By
Oldiesmann
May 10 2025, 1:29 AM
Referenced Files
F59855618: Screenshot_20250510-164423.png
May 10 2025, 8:56 PM
F59840579: image.png
May 10 2025, 1:29 AM
F59840560: image.png
May 10 2025, 1:29 AM

Description

Steps to replicate the issue (include links if applicable):

  • Install the RSS extension and try to put an RSS feed on a page
  • Attempt to access rest.php

What happens?:
Internal server error because various methods in the mediawiki/includes/http files that use psr/http-message don't have type hinting

What should have happened instead?:
RSS feed displayed as expected for RSS extension
rest.php returns 404 when accessed directly

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):
1.43.1

Other information (browser name/version, screenshots, etc.):
Issue previously mentioned in https://phabricator.wikimedia.org/T333993 and other tasks referenced there

Example errors:

image.png (64×737 px, 18 KB)

image.png (67×813 px, 19 KB)

Updating this at the request of @Dinoguy1000 per Discord...

The problem here is that composer.json requires psr/http-message version 1.1, which uses type hinting, while the mediawiki code that uses that library does not have type hinting. https://phabricator.wikimedia.org/T335073 is what led me down this path.

Searching code review, this is the change where the psr/http-message version was bumped up to 1.1 from 1.0.1: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/985025

Also cc @Reedy since he was the author of the breaking commit

Event Timeline

The error is about return type declarations resulting in a mismatch for the function signature.

The return type declarations are added with 2.0 (https://github.com/php-fig/http-message/commit/54df5d4d336354de566dc6bb5d99cc0954b117f8) and not part of mediawiki/core

RSS extension does not installs any further composer packages, so it not clear why this only happen when install that on your machine.

The error can happen when running "composer update" in the extension folder and not using the composer merge plugin from core, see more about it in T389005: Declaration of MWCallbackStream::write($string) must be compatible with Psr\Http\Message\StreamInterface::write(string $string)

Indeed, this is almost certainly not the fault of the linked commit.

CI would have been upset a long tine ago if so

Return types were added to the psr-message library in version 1.1, per
https://phabricator.wikimedia.org/T335073

That is the version that is installed on my installation as well. The error
in T335073 is the exact one I was getting.

Here is a partial list of composer libraries in my installation (I'm not home at the moment so I can only provide screenshots from the server control panel via my phone)

Screenshot_20250510-164423.png (1×864 px, 140 KB)

Return types were added to the psr-message library in version 1.1, per
https://phabricator.wikimedia.org/T335073

No they weren't. You've presumably got something (probably in an extension) installing version 2.0.

Just because you've got 1.1 in mediawiki core, doesn't mean somewhere else (likely a skin, or an extension) doesn't also have version 2.0 in its own vendor repository, which is also being included later.

https://github.com/php-fig/http-message/blob/1.1/src/StreamInterface.php#L55-L61

/**
 * Returns the current position of the file read/write pointer
 *
 * @return int Position of the file pointer
 * @throws \RuntimeException on error.
 */
public function tell();

https://github.com/php-fig/http-message/blob/1.1/src/StreamInterface.php#L110-L117

/**
 * Write data to the stream.
 *
 * @param string $string The string that is to be written.
 * @return int Returns the number of bytes written to the stream.
 * @throws \RuntimeException on failure.
 */
public function write(string $string);

Further update on this... I talked to a friend who knows a whole lot more about composer and PHP than I do and we tracked down the problem to the GoogleLogin extension, which apparently includes version 2.0 of psr/http-message. Disabling that extension fixes the error, so I will either have to modify my copy of the MWCallbackStream.php file or just not use that extension.

Or use https://github.com/wikimedia/composer-merge-plugin

Does the extension explicitly want 2.0, or is it just a loose dependancy that results in it picking the highest versions or can?

It isn't listed in composer.json for that extension at all - it's just included as one of the libraries shipped with that extension. I didn't install it via Composer either. Do I need to rerun composer update after each extension I install?

Depends how you install them, how you set them up and whether they have their own dependencies

Does the extension explicitly want 2.0, or is it just a loose dependancy that results in it picking the highest versions or can?

GoogleLogin has a dependency on google/apiclient, that has a dependency on guzzlehttp/psr7 in version 2.6. That dependency allows psr/http-message: ^1.1 || ^2.0 since 2.5.

See 427b6e95853b78db67d782143b3f84b0750165be how another extension has bypass this issue, when composer is running from within the extension folder and not using the merge plugin

I was just helping someone who had this randomly happen to them after doing a developer setup.

Since this seems to happen sometimes, would it make sense for us to just add the type-hints to MWCallbackStream?

public function write( string $string ): int {

Is all that's needed, it doesn't seem to cause any problems, and it's somewhat futureproofing us against Guzzle really bumping its required version.

Shortly after writing that, I found: T389272