Repository navigation
Reject versions with unparsable constraints instead of stripping them - #467
Merged
Merged
Conversation
Add MetadataSanitizer to strip composer link constraints that Composer cannot parse (require, require-dev, conflict, provide, replace) while preserving valid strings and special 'self.version'. Use it in CreateFromZip so imported version metadata is cleaned before saving (including re-imports). Add unit tests for MetadataSanitizer and feature tests for CreateFromZip behavior. Aims to resolve #435 and fix similar issue around ver contraints.
Stripping an unparsable require or conflict entry makes the version installable without that constraint. Composer skips such versions instead, so do the same: - CreateFromZip rejects the version with a validation error naming the invalid links, so uploads and webhook pushes get a 422 and nothing is stored - ComposerPackageResource leaves already stored versions with invalid constraints out of the p2 metadata, so existing packages load again without a re-import
Filtering invalid versions on every p2 request only matters for installs that already stored them, so remove them once with versions:clean (supports --dry-run) instead. Also align the validator with Composer's ArrayLoader: link keys that are not an array and constraints that are not a string are ignored by Composer, so they no longer count as invalid.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on #458 by @codearachnid and fixes #435.
What changed
The first commit is the original change from #458. The only difference is that its unrelated
composer.lockchanges are left out, because they would have rolled back the dependency upgrades from #463.The rest changes the approach. Stripping an unparsable
requireorconflictentry makes that version installable without the constraint (e.g. alaravel/framework: ^^12requirement disappears, so the version installs on Laravel 10). Composer and Packagist skip such versions instead, so we now do the same:CreateFromZipruns the newConstraintValidatoroverrequire,require-dev,conflict,provideandreplace. If a constraint can't be parsed it throwsInvalidConstraintException, which is rendered as a 422 validation error naming the invalid links (e.g.invalid version constraint in require.laravel/framework). Nothing is stored and an existing version is left untouched. Queued tag imports fail just that job, since the import batch allows failures.php artisan versions:cleanremoves already stored versions with invalid constraints, including their archives. It supports--dry-run, likearchives:clean.ArrayLoader, the validator ignores link keys that aren't an array and constraints that aren't a string. Only a string constraint that won't parse counts as invalid.Upgrading
Installs that already have broken versions run this once after upgrading: