Repository navigation
fix(ci): audit PHP dependencies with composer audit and pin PHP 8.2.35 - #268
Merged
Merged
Conversation
oleksandr-nc
changed the title
oleksandr-nc
force-pushed
the
fix/psalm-roave-php-conflict
branch
2 times, most recently
from
October 22, 2026 08:11
3745d41 to
9b86383
Compare
Composer resolves dependencies against config.platform.php rather than the PHP that runs it. The pin was 8.2; it now names 8.2.35, the PHP 8.2 security release of 2026-10-21, so dependencies are resolved for a patched PHP 8.2, the lowest version Nextcloud 33 supports. composer.lock changes only in content-hash and platform-overrides; no locked package moves. info.xml now declares the PHP 8.2 minimum as well, which Nextcloud 33 already implies. Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>
The psalm workflow checked the PHP dependencies by requiring roave/security-advisories, a package that conflicts with every version that has a known advisory. Since 2026-10-21 it lists vulnerable PHP releases as well, everything before 8.2.35 on the 8.2 line, and it resolves against config.platform.php, so a pinned platform PHP fails the step as soon as a newer PHP security release is listed. composer audit --locked checks composer.lock against the advisories Packagist collects from GitHub and FriendsOfPHP, and fails on any advisory or abandoned package. It resolves nothing, so the PHP version plays no part. Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>
require-dev pinned nextcloud/ocp to dev-master, whose stubs now require PHP 8.3 like Nextcloud master itself, so a full composer update failed against the 8.2.35 platform PHP. The stubs now follow stable33, the oldest server the app supports. The psalm workflow replaces the stubs with the server versions it analyses against, so CI is unaffected; in composer.lock only the nextcloud/ocp entry and the hash change. Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>
oleksandr-nc
force-pushed
the
fix/psalm-roave-php-conflict
branch
from
October 22, 2026 09:03
630d3bd to
8ff17a6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since 2026-10-22 every psalm job has failed at
composer require --dev roave/security-advisories:dev-latest: on 2026-10-21 the package started listing every PHP release before 8.2.35 as a conflict, andconfig.platform.php(8.2) makes Composer resolve as PHP 8.2.0, although the runner has 8.2.35.Dependencies are audited with composer audit
The step now runs
composer audit --locked. It checkscomposer.lockagainst the advisories Packagist collects from GitHub and FriendsOfPHP and fails on any advisory or abandoned package. It resolves nothing, so the PHP version plays no part in whether it passes.The platform PHP is pinned to 8.2.35
The pin names the PHP 8.2 security release of 2026-10-21 instead of
8.2, and changescomposer.lockonly in its hash andplatform-overrides.info.xmlnow declares the PHP 8.2 minimum, which Nextcloud 33 already implies.The OCP stubs follow Nextcloud 33
require-devpinnednextcloud/ocptodev-master, whose stubs now require PHP 8.3 like Nextcloud master, so under the pin a fullcomposer updatefailed. They now follow stable33, the oldest server the app supports. The psalm workflow replaces the stubs with the server versions it analyses against, so CI is unaffected; incomposer.lockonly thenextcloud/ocpentry and the hash change.🤖 AI (if applicable)