Currently, preferred-install accepts the hash of patterns as the value in the composer.json. I've followed the same approach as used in extra and platform for letting the user define install preferences through CLI in the format: `composer config preferred-install my-organization/stable-package.dist`.
This includes two breaking changes:
- the hostname is not resolved in the case of an IP address.
- a hostname with a trailing period (FQDN) is not matched.
This brings the basic implementation in line with curl behaviour, with
the addition of full IP address and range matching (curl does not
differentiate between IP addresses host names).
The NO_PROXY environment variable can be set to either a comma-separated
list of host names that should not use a proxy, or single asterisk `*`
to match all hosts.
- Port numbers can be included by prefixing the port with a colon `:`.
- IP addresses can be used, but must be enclosed in square brackets
`[...]` if they include a port number.
- IP address ranges can specified in CIDR notation, separating the IP
address and prefix-length with a forward slash `/`.
We now output an update when only a source or dist ref changes even if
it's a stable version so in these cases the output needs to contain the
ref to make it clear to users what changed
This also changes the PRE/POST_PACKAGE_INSTALL/UPDATE/UNINSTALL events to have less information available on them, repositorySet, request and policy are gone
* github-composer/2.0: (63 commits)
Fix PSR warnings for optimized autoloader, refs #8397, refs #8403
Prepare 1.9.1 changelog
Output a hint that maybe you are not in the right directory, fixes#8404
Fix PSR warnings for optimized autoloader, refs #8397, refs #8403
Fix tests for PSR-fix in optimized autoloader, refs #8397
Fix tests for PSR-fix in optimized autoloader, refs #8397
Change PSR-fix for optimized autoloader to only warn for now, refs #8397
Fix output of dump-autoload command to avoid interfering with warnings, refs #8397
Remove credentials from git remotes in cache and vendor dirs
Avoid overwriting credentials with existing ones from git repos, refs #8293
Fix github auth to try https with pwd also, fixes#8356
Fix gitlab support for basic-auth fallback from ssh URLs
Avoid clearing the error output during removeDirectory execution, losing git error output, fixes#8351
Move test file parsing into try/catch block to avoid phpunit swallowing errors
make optimized autoloader respect PSR standards
Validate composer show with --tree and --path options set (#8390)
Don't show root warning for docker containers
Added phpdoc for ComposerAutoloaderInit$SHA1::getLoader() (#8393)
Validate schema name, type and version
Fix require command to allow working on network mounts, fixes#8231
...
The solver now only calculates a lock file transaction which does not
need to be sorted in order of dependencies. This is only necessary for
the local repo transaction generated without the solver during install
The pool builder tries to be minimal so it's fine for present/locked
packages not be assigned a solver/pool id. Adding a test to verify
correct creation of uninstall jobs
These special commands no longer (ab)use the partial update mechanism
but rather create a special install request for all current lock file
contents and later override any modified code references to the
originals. This leads to up to date remote metadata but no other
changes.
Commit: 149250ab92
ProcessExecutor::escape handled a false value inconsistently across
platforms, returning an emtpy string on Windows, otherwise `''`. This
is fixed to return `""` on Windows.
The GitDownloaderTest code has been appropriately updated.
This only removes the credentials if they are managed by composer auth.json or equivalent, if the credentials were present in the package URL to begin with they might remain
Refs #8293Fixes#3644Closes#3608
Particularly the test
tests/Composer/Test/Fixtures/installer/partial-update-downgrades-non-whitelisted-unstable.test
is interesting because it verifies that an older version will be
installed on update if the new one is only present in the installed repo
or vendor dir. This was the cause of a lot of weird edge cases and
unreliable update behavior in Composer v1
As a result some lock file packages are no longer in the pool, so the
former installed map, now present map cannot use package ids anymore
Need to revisit some more code later to simplify this, todo notes left
Ensures packages get loaded from locked repo correctly. We may not want
to support this particular use-case at all, but for now it fixes the
existing test, so we may want to revisit this later.
New approach is to use only the solved set of packages as input and then
to resolve with only the non-dev requirements and to mark everything as
dev that is not part of the result set, rather than transitioning a
temporary local repo state by uninstalling dev packages.
* github-composer/2.0: (48 commits)
Fix missing use/undefined var
Split up steps on VCS downloaders to allow doing network operations before touching the filesystem on GitDownloader, fixes#7903
Fix use statement
Deduplicate findHeaderValue code
Add install-path to the installed.json for every package, fixes#2174, closes#2424
Remove unnecessary config from phpstan
Make sure the directory exists and will not block installation later when downloading
Avoid wiping the whole target package if download of the new one fails, refs #7929
Only empty dir before actually installing packages, fixes#7929
Improve output when installing packages
Show best possible version in diagnose command
Remove extra arg
Allow path repos to point to their own source dir as install target, resulting in noop, fixes#8254
Fix use of decodeJson
Fix update mirrors to also update transport-options, fixes#7672
Fix updating or URLs to include dist type and shasum, fixes#8216
Fix origin computation
Improve handling of non-standard ports for GitLab and GitHub installs, fixes#8173
Load packages from the lock file for check-platform-reqs if no dependencies have been installed yet, fixes#8058
Fix error_handler return type declaration
...
* 2.0: (101 commits)
SVN: hide passwords for debug output
Free $solver asap
fixes#8179
[minor] Fixed a typo in the CHANGELOG.md.
Update deps
Update changelog
Revert "Allow overriding self-update target file with envvar COMPOSER_SELF_UPDATE_TARGET" Revert "Add docs for COMPOSER_SELF_UPDATE_TARGET, refs #8151"
Add docs for COMPOSER_SELF_UPDATE_TARGET, refs #8151
Fix display of HHVM warning appearing when HHVM is not in use, fixes#8138
Read classmap-authoritative and apcu-autoloader from project config when installing via create-project, fixes#8155
Use possessive quantifiers
Update xdebug-handler to 1.3.3
fixes#8159
Allow overriding self-update target file with envvar COMPOSER_SELF_UPDATE_TARGET
flag should come before script name
use full command name, not abbreviated/alias
modify text
Document the alternatives to disable the default script timeout
Anchor pattern
Fix URL resolution for Composer repositories
...
* master: (48 commits)
SVN: hide passwords for debug output
Free $solver asap
fixes#8179
[minor] Fixed a typo in the CHANGELOG.md.
Update deps
Update changelog
Revert "Allow overriding self-update target file with envvar COMPOSER_SELF_UPDATE_TARGET" Revert "Add docs for COMPOSER_SELF_UPDATE_TARGET, refs #8151"
Add docs for COMPOSER_SELF_UPDATE_TARGET, refs #8151
Fix display of HHVM warning appearing when HHVM is not in use, fixes#8138
Read classmap-authoritative and apcu-autoloader from project config when installing via create-project, fixes#8155
Use possessive quantifiers
Update xdebug-handler to 1.3.3
fixes#8159
Allow overriding self-update target file with envvar COMPOSER_SELF_UPDATE_TARGET
flag should come before script name
use full command name, not abbreviated/alias
modify text
Document the alternatives to disable the default script timeout
Anchor pattern
Fix URL resolution for Composer repositories
...
Composer was unable canonicalize URLs in non-HTTP(S) Composer
repositories. For example it was not possible to use a `providers-url`
in a repository loaded via the `file://` scheme.
See also: #8115
- Introduce separate Lock and LocalRepo transactions, one for changes
to the lock file, one for changes to locally installed packages based
on lock file
- Remove various hacks to keep dev dependencies updated and
incorporated the functionality into the transaction classes
- Remove installed repo, there are now local repo, locked repo and
platform repo
- Remove access to local repo from solver, only supply locked packages
- Update can now be run to modify the lock file but not install packages
to local repo
* master:
Follow up to #7946 test: add solver flag to assert path execution
Fix tests
Make sure config command output is also output on --quiet so that warnings can be hidden, fixes#7963
Recognize composer-plugin-api as a platform package, fixes#7951
Quote wildcards to avoid issues in some shells, fixes#7960
Avoid dumping null values for dist reference/shasum and source reference, fixes#7955
Soften hard exit after revert of composer file
Make unixy proxy code POSIX compatible
Update aliases.md
Same but for Problem.php
Better error message for present but incompatible versions
Fix inconsistent casing
Don't do (new Foo())->bar() - not 5.3-compatible
Support identifying the HHVM version when not running with HHVM
* master:
Fix solver problem exceptions with unexpected contradictory "Conclusions"
Also load config into IO if not freshly created
Only load configuration into IO if IO is available
Fix defaultRepos fallback does not use auth config
Add warning/info msg when tweaking disable-tls setting to avoid confusion, fixes#7935
* 1.8:
Fix solver problem exceptions with unexpected contradictory "Conclusions"
Also load config into IO if not freshly created
Only load configuration into IO if IO is available
Fix defaultRepos fallback does not use auth config
This 5 character fix comes with a solver test as well as a functional
installer test essentially verifying the same thing. The solver test is
more useful when working on the solver. But the functional test is less
likely to be accidentally modified incorrectly during refactoring, as
every single package, version and link in the rather complex test
scenario is essential, and a modified version of the test may very well
still result in a successful installation but no longer verify the bug
described below.
Background:
In commit 451bab1c2c from May 19, 2012 I
refactored literals from complex objects into pure integers to reduce
memory consumption. The absolute value of an integer literal is the id
of the package it refers to in the package pool. The sign indicates
whether the package should be installed (positive) or removed (negative),
So a major part of the refactoring was swapping this call:
$literal->getPackageId()
For this:
abs($literal)
Unintentionally in line 554/523 I incorrectly applied this change to the
line:
$this->literalFromId(-$literal->getPackageId());
It was converted to:
-abs($literal);
The function literalFromId used to create a new literal object. By using
the abs() function this change essentially forces the resulting literal
to be negative, while the minus sign previously inverted the literal, so
positive into negative and vice versa.
This particular line is in a function meant to analyze a conflicting
decision during dependency resolution and to draw a conclusion from it,
then revert the state of the solver to an earlier position, and attempt
to solve the rest of the rules again with this new "learned" conclusion.
Because of this bug these conclusions could only ever occur in the
negative, e.g. "don't install package X". This is by far the most likely
scenario when the solver reaches this particular line, but there are
exceptions.
If you experienced a solver problem description that contained a
statement like "Conclusion: don't install vendor/package 1.2.3" which
directly contradicted other statements listed as part of the problem,
this could likely have been the cause.
hhvm-nightly (and the next release) are no longer able to execute
Composer. Support executing Composer with PHP to install dependencies
for hack projects.
The goal is for this to be temporary, until Hack identifies a new
package manager, given that Composer does not aim to be a multi-language
package manager.
fixes#7734
The update command can receive a pattern like `vendor/prefix-*`
to update all matching packages.
This has not worked if multiple packages, depending on each other,
where matched to the given pattern. No package has been updated
in this case as only the first package matching the pattern was
added to the whitelist.
Pool construction depends on the install request now, so only required
packages get loaded, add some structure for future asynchronously
loading composer repositories
Breaking change for the plugin interface so bumping the version of
composer-plugin-api to 2.0.0
First step for a refactoring of the package metadata loading mechanism
Added a encapsulated group to the replacement parameter of the `preg_replace` for GitLab in `\Composer\Util\Url::updateDistReference()`. This fixes#6994.
Where systems use multiple ini files it is perhaps more useful to
suggest running `php --ini` to see their locations, rather than showing
the loaded php.ini (if one exists).
Some packages, e. g. `tm/tooly-composer-script`, are using the composer classes to e. g. create symlinks or perform other file operations. While there's only a `copyThenRemove()` method this commit introduces a new `copy()` method. `copy()` behaves the same as the copy part of `copyThenRemove()` did with one exception: it returns `true` on success and `false` on failure. Copying a directory may lead to a `false`, while the whole directory or some of its files couldn't been copied. To ensure backwards compatibility `copyThenRemove()` calls `copy()` now. This commit also adds the necessary tests.
When currently executing the `require` command for a package that is already listed in `require(-dev)`, one must use the exact same, case matching package name as written in `composer.json`. That is, if one changes the case of a character in the package name, the `require` command will add a new entry to `require(-dev)`, instead of updating the existing one.
This commit fixes the described behaviour to make it consistent with other commands like `update` that are already case insensitive.
A negative list of non-feature-branches names
is already supported - this patch adds a list of
branches names which *will* be considered as
feature branches.
Allows changing the currently hardcoded set of
expected feature branch names, from:
* master|trunk|default|develop
To any set of names or patterns that you desire.
Current versions of Git output the commit hash as detached HEAD instead
of FETCH_HEAD. The VersionGuesser should be able to handle commit hashes
as well as FETCH_HEAD to detect the correct branch of a commit.
It is known that composer update takes a lot of memory: #5915, #5902,
I am playing with a profiler (@blackfireio) to make a demo in my local
PHP meetup (@phpvigo) and I found out a way to use less memory. These
are my first tests:
* Private project using PHP 5.6:
* Memory: from 1.31GB to 1.07GB
* Wall Time: from 2min 8s to 1min 33s
* symfony-demo using PHP 7.1 in my old mac book:
* Memory: from 667MB to 523MB
* Wall Time: from 5min 29s to 5min 28s
Not use an array inside conflict rules is this improvement main idea:
```php
<?php
//Memory 38MB
gc_collect_cycles();
gc_disable();
class Rule
{
public $literals;
public function __construct(array $literals)
{
$this->literals = $literals;
}
}
$rules = array();
$i = 0;
while ($i<80000){ //
$i++;
$array = array(-$i, $i);
$rule = new Rule($array);
$rules[] = $rule;
}
```
```php
<?php
//Memory 11.1MB
gc_collect_cycles();
gc_disable();
class Rule2Literals
{
public $literal1;
public $literal2;
public function __construct($literal1, $literal2)
{
$this->literal1 = $literal1;
$this->literal2 = $literal2;
}
}
$rules = array();
$i = 0;
while ($i<80000){ //
$i++;
$rule = new ConflictRule(-$i, $i);
$rules[] = $rule;
}
```
More info https://github.com/composer/composer/pull/6168
The former implementation used the 'src' endpoint which returned some meta data as well.
This has been replaced with the 'raw' endpoint which does not return the meta data and does not need an extra JSON decode step.
Store the Bitbucket access-token (and the expiration time) so it can be re-used within the time it is valid.
The Bitbucket::requestToken and Bitbucket::getToken now only return the access-token and not all other parameters it receives from the Bitbucket API.
commit 3994b556dcffcde7b1801c8bc712f3127e8f8e7c
Author: John Whitley <john.whitley@berea.eu>
Date: Tue Aug 16 09:02:53 2016 +0100
https://github.com/composer/composer/issues/5600
This alters the default flag for loadOptions in
\Composer\Package\Loader\ArrayLoader to true; and alters the assumption
of the test to reflect this change.
**Rationale**
The `\Composer\Package\Loader\ArrayLoader` test (defined in
tests/Composer/Test/Package/Loader/ArrayLoaderTest.php) assumed that a
new `\Composer\Package\Loader\ArrayLoader` instance would be always
created with the optional flag loadOptions set to true.
```php
$this->loader = new \Composer\Package\Loader\ArrayLoader(null, true);
```
This change alters the general case to reflect the default assumption as
defined in the test.
commit b75fc4ad7238bc50f724bd29446ccbc33e82c34c
Author: John Whitley <john.whitley@berea.eu>
Date: Mon Aug 15 16:55:27 2016 +0100
Altered the test for ArrayLoader to use the default loadConfig flag, and to test the true and false states for the loadConfig flag
Projects that add binaries to `vendor-bin` can now execute those via the same command as projects that consume them without installing them first.
In list overview local commands have a `(local)` tag to distinguish them from commands installed in `vendor-bin`.
Local binaries take precedence over `vendor-bin` which takes precedence over binaries in path.
When creating a DownloaderMock a home config dir is
ensured to exist, so that no test fails for lack of it
that on a regular run would be set by the Factory
Jordi Boggiano