Repository navigation
chore(deps): drop roave/security-advisories from dev dependencies - #115
Merged
Merged
Conversation
roave/security-advisories dev-latest now conflicts with php <8.2.35, so composer cannot install the dev dependencies on PHP 7.4, 8.0 or 8.1. The library still supports and tests those versions, and the package only guarded dev installs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Removes
roave/security-advisoriesfromrequire-devincomposer.json. Nothing else changes.Motivation and context
roave/security-advisoriesdev-latestnow declares a conflict with PHP itself (php <8.2.35|>=8.3,<8.3.36|>=8.4,<8.4.27|>=8.5,<8.5.12). Composer refuses to install the dev dependencies on any PHP release in that range, which covers every version CI runs: 8.1 for coding standards, static analysis and coverage, and 7.4, 8.0 and 8.1 in the unit test matrix.The library still declares
"php": "^7.4 || ^8"and tests those versions, so CI cannot pass while the package is required. The last greenbuildrun onmainwas on 2026-09-25 (release 1.12.8); the green runs on 2026-10-01 came from Dependabot. The nextbuildrun, on #114 on 2026-10-23, failed at "Install dependencies" with:The package only guarded dev installs of this repository. A
require-deventry is never installed for projects that depend on the library, so library users are unaffected.How has this been tested?
composer validate --strictreports the same single warning as onmain(a description for the non-existentdev:build:cleanscript), and no other issue.composer update --ignore-platform-req=phpresolves withoutroave/security-advisories.vendor/bin/phpunit --no-coverageon PHP 8.3: 308 tests pass, the same count as onmain.Types of changes
PR checklist