Composer: Take symfony compatibility into account when suggesting changes

[petski]

Starting this discussion based on the request @rarkins made in #24723 (comment)

Symfony has multiple release branches. At the time of writing the 7.x releases are rolling releases and the 6.4.* releases are LTS (Long Term Support) releases.

If a developer chooses to follow the LTS branch, he/she installs symfony/flex and sets extra.symfony.require to the required version. This way, packages requireing other packages under the "Symfony umbrella" (more about that later) will be restricted to the constraint in extra.symfony.require.

See thiscomposer.json snippet as an example:

{
    "require": {
        "gedmo/doctrine-extensions": "^3.17",
        "symfony/flex": "^2",
        "symfony/framework-bundle": "6.4.*"
   },
   "extra": {
        "symfony": {
            "require": "6.4.*"
        }
    }
}

Package gedmo/doctrine-extensions has "symfony/cache": "^5.4 || ^6.0 || ^7.0" as a requirement. Because symfony/flex hooks into composer, the installed symfony/cache version will be the one compliant with 6.4.*.

Renovate doesn't have this logic on board, resulting in a PR with a (undesired) bump to a symfony/cache matching ^7.0.

Symfony superstar @nicolas-grekas explains what is considered to be under the "Symfony umbrella" here #24723 (comment)

The flex hook can be found here: https://github.com/symfony/flex/blob/2.x/src/PackageFilter.php#L104

I created a test repo which reproduces this issue at https://github.com/petski/renovate-31910.

If Renovate suggests a major Symfony bump (i.e. from 6.4.x to 7.x), extra.symfony.require should also be bumped accordingly.

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

If you need help with running renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team

[rarkins]

Please use the reproduction template above and make note of the instructions, e.g.

• Expected vs Observed behavior description
• Minimal dependencies
• Minimal config

[petski]

Done in https://github.com/petski/renovate-31910. Updated the first post/comment accordingly.

[rarkins]

Which of these two are you meaning?

1. Renovate should not update gedmo/doctrine-extensions to 3.17.1 because it's incompatible with your symfony settings, or
2. Renovate should update gedmo/doctrine-extensions to 3.17.1 but the symfony/flex version in the lock file must stay as-is?

[petski]

3. Renovate should update gedmo/doctrine-extensions to 3.17.1 but the symfony/cache version in the lock file must stay as-is (or at least comply with the 6.4.* constraint)

[rarkins]

Yes, that's what I was meaning to say actually.

But in this case it's confusing to me. As far as I can tell, it's composer itself which is making that update, and not Renovate directly. Why would composer choose a version of symfony/cache which is incompatible?