From 4e3b4c19bb91cee6e9011166e64ecd2cb3b08554 Mon Sep 17 00:00:00 2001 From: Oleksander Piskun Date: Thu, 22 Oct 2026 07:43:34 +0000 Subject: [PATCH 1/3] fix(deps): pin the platform PHP to 8.2.35 Composer resolves dependencies against config.platform.php rather than the PHP that runs it. The pin was 8.2; it now names 8.2.35, the PHP 8.2 security release of 2026-10-21, so dependencies are resolved for a patched PHP 8.2, the lowest version Nextcloud 33 supports. composer.lock changes only in content-hash and platform-overrides; no locked package moves. info.xml now declares the PHP 8.2 minimum as well, which Nextcloud 33 already implies. Signed-off-by: Oleksander Piskun --- appinfo/info.xml | 1 + composer.json | 2 +- composer.lock | 4 ++-- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/appinfo/info.xml b/appinfo/info.xml index b47b022c..b33df6a2 100644 --- a/appinfo/info.xml +++ b/appinfo/info.xml @@ -23,6 +23,7 @@ https://github.com/nextcloud/integration_github/issues https://github.com/nextcloud/integration_github/raw/main/img/screenshot1.jpg + diff --git a/composer.json b/composer.json index 46e0aab3..3142ca70 100644 --- a/composer.json +++ b/composer.json @@ -32,7 +32,7 @@ "optimize-autoloader": true, "classmap-authoritative": true, "platform": { - "php": "8.2" + "php": "8.2.35" }, "allow-plugins": { "bamarni/composer-bin-plugin": true, diff --git a/composer.lock b/composer.lock index 6e3602f5..73ffc8dd 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "c7083f1461bd67ef44ce5c9f3c3baecf", + "content-hash": "54f32437c2483153a891730ecb788a9e", "packages": [ { "name": "bamarni/composer-bin-plugin", @@ -907,7 +907,7 @@ "ext-mbstring": "*" }, "platform-overrides": { - "php": "8.2" + "php": "8.2.35" }, "plugin-api-version": "2.9.0" } From ee4be24854f338de92be06c803fa638e8fe858cb Mon Sep 17 00:00:00 2001 From: Oleksander Piskun Date: Thu, 22 Oct 2026 07:45:45 +0000 Subject: [PATCH 2/3] fix(ci): audit the locked PHP dependencies for security advisories The psalm workflow checked the PHP dependencies by requiring roave/security-advisories, a package that conflicts with every version that has a known advisory. Since 2026-10-21 it lists vulnerable PHP releases as well, everything before 8.2.35 on the 8.2 line, and it resolves against config.platform.php, so a pinned platform PHP fails the step as soon as a newer PHP security release is listed. composer audit --locked checks composer.lock against the advisories Packagist collects from GitHub and FriendsOfPHP, and fails on any advisory or abandoned package. It resolves nothing, so the PHP version plays no part. Signed-off-by: Oleksander Piskun --- .github/workflows/psalm-matrix.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/psalm-matrix.yml b/.github/workflows/psalm-matrix.yml index 3b5e87a9..970acfa4 100644 --- a/.github/workflows/psalm-matrix.yml +++ b/.github/workflows/psalm-matrix.yml @@ -68,7 +68,7 @@ jobs: composer i - name: Check for vulnerable PHP dependencies - run: composer require --dev roave/security-advisories:dev-latest + run: composer audit --locked - name: Install dependencies # zizmor: ignore[template-injection] run: composer require --dev 'nextcloud/ocp:${{ matrix.ocp-version }}' --ignore-platform-reqs --with-dependencies From 8ff17a614fb7536fe36b62d992bdfa35fd3b7cef Mon Sep 17 00:00:00 2001 From: Oleksander Piskun Date: Thu, 22 Oct 2026 08:36:07 +0000 Subject: [PATCH 3/3] fix(deps): base the OCP stubs on Nextcloud 33 require-dev pinned nextcloud/ocp to dev-master, whose stubs now require PHP 8.3 like Nextcloud master itself, so a full composer update failed against the 8.2.35 platform PHP. The stubs now follow stable33, the oldest server the app supports. The psalm workflow replaces the stubs with the server versions it analyses against, so CI is unaffected; in composer.lock only the nextcloud/ocp entry and the hash change. Signed-off-by: Oleksander Piskun --- composer.json | 2 +- composer.lock | 19 +++++++++---------- 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/composer.json b/composer.json index 3142ca70..b00e15c6 100644 --- a/composer.json +++ b/composer.json @@ -41,7 +41,7 @@ }, "require-dev": { "ext-mbstring": "*", - "nextcloud/ocp": "dev-master" + "nextcloud/ocp": "dev-stable33" }, "extra": { "bamarni-bin": { diff --git a/composer.lock b/composer.lock index 73ffc8dd..8ec7c16d 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "54f32437c2483153a891730ecb788a9e", + "content-hash": "817a89707eb0a02d54c51a0cc77d01b0", "packages": [ { "name": "bamarni/composer-bin-plugin", @@ -694,30 +694,29 @@ "packages-dev": [ { "name": "nextcloud/ocp", - "version": "dev-master", + "version": "dev-stable33", "source": { "type": "git", "url": "https://github.com/nextcloud-deps/ocp.git", - "reference": "26aac678bd92adaa91e4e5715ba11cb3f627361d" + "reference": "2e0c4f33f8ea2861159700112abbd056a7b93583" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/nextcloud-deps/ocp/zipball/26aac678bd92adaa91e4e5715ba11cb3f627361d", - "reference": "26aac678bd92adaa91e4e5715ba11cb3f627361d", + "url": "https://api.github.com/repos/nextcloud-deps/ocp/zipball/2e0c4f33f8ea2861159700112abbd056a7b93583", + "reference": "2e0c4f33f8ea2861159700112abbd056a7b93583", "shasum": "" }, "require": { - "php": "~8.1 || ~8.2 || ~8.3 || ~8.4 || ~8.5", + "php": "~8.2 || ~8.3 || ~8.4 || ~8.5", "psr/clock": "^1.0", "psr/container": "^2.0.2", "psr/event-dispatcher": "^1.0", "psr/log": "^3.0.2" }, - "default-branch": true, "type": "library", "extra": { "branch-alias": { - "dev-master": "34.0.0-dev" + "dev-stable33": "33.0.0-dev" } }, "notification-url": "https://packagist.org/downloads/", @@ -737,9 +736,9 @@ "description": "Composer package containing Nextcloud's public OCP API and the unstable NCU API", "support": { "issues": "https://github.com/nextcloud-deps/ocp/issues", - "source": "https://github.com/nextcloud-deps/ocp/tree/master" + "source": "https://github.com/nextcloud-deps/ocp/tree/stable33" }, - "time": "2026-03-14T01:06:50+00:00" + "time": "2026-10-06T03:44:03+00:00" }, { "name": "psr/clock",