Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conflicts with roave/security-advisories #20

Closed
mayestik1 opened this issue Apr 30, 2024 · 3 comments · Fixed by #23
Closed

Conflicts with roave/security-advisories #20

mayestik1 opened this issue Apr 30, 2024 · 3 comments · Fixed by #23
Labels
bug Something isn't working

Comments

@mayestik1
Copy link

Please fix package "replaces" information because of
Problem 1 - Root composer.json requires paragonie/ecc ^2.1 -> satisfiable by paragonie/ecc[v2.1.0]. - roave/security-advisories dev-latest conflicts with mdanter/ecc <2 (paragonie/ecc v2.1.0 replaces mdanter/ecc *). - Root composer.json requires roave/security-advisories dev-latest -> satisfiable by roave/security-advisories[dev-latest].

Maybe something like this
"replace": { "mdanter/ecc": "<2.0" }

@paragonie-security
Copy link

Thanks, let's see if #23 fixes the problem. It should, but better to test.

@paragonie-security
Copy link

Before the PR

{
  "require": {
    "paragonie/ecc": "^2.1",
	"roave/security-advisories": "dev-latest"
  }
}

Yields:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires paragonie/ecc ^2.1 -> satisfiable by paragonie/ecc[v2.1.0].
    - roave/security-advisories dev-latest conflicts with mdanter/ecc <2 (paragonie/ecc v2.1.0 replaces mdanter/ecc *).
    - Root composer.json requires roave/security-advisories dev-latest -> satisfiable by roave/security-advisories[dev-latest].

After the PR

{
  "require": {
    "paragonie/ecc": "dev-master",
	"roave/security-advisories": "dev-latest"
  }
}

Yields:

Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires paragonie/ecc dev-master -> satisfiable by paragonie/ecc[dev-master].
    - roave/security-advisories dev-latest conflicts with mdanter/ecc <2 (paragonie/ecc dev-master replaces mdanter/ecc <2).
    - Root composer.json requires roave/security-advisories dev-latest -> satisfiable by roave/security-advisories[dev-latest].

The only thing we can really do here is, not replace anything. And, instead, just create a separate meta-package that does that.

@paragonie-security
Copy link

After removing the replace directive:

Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires paragonie/ecc dev-master -> satisfiable by paragonie/ecc[dev-master].
    - roave/security-advisories dev-latest conflicts with mdanter/ecc <2 (paragonie/ecc dev-master replaces mdanter/ecc <2).
    - Root composer.json requires roave/security-advisories dev-latest -> satisfiable by roave/security-advisories[dev-latest].


D:\tmp>del composer.phar

D:\tmp>php composer.phar update
Loading composer repositories with package information
Updating dependencies
Lock file operations: 4 installs, 0 updates, 0 removals
  - Locking genkgo/php-asn1 (v2.7.0)
  - Locking paragonie/ecc (dev-master 197bb7f)
  - Locking paragonie/sodium_compat (v2.0.1)
  - Locking roave/security-advisories (dev-latest a6cc84f)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 0 installs, 1 update, 0 removals
  - Downloading paragonie/ecc (dev-master 197bb7f)
  - Upgrading paragonie/ecc (v2.0.0 => dev-master 197bb7f): Extracting archive
1 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
1 package you are using is looking for funding.
Use the `composer fund` command to find out more!
No security vulnerability advisories found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants