loco/loco-php-sdk

Up `guzzle/psr7` version constraint

Closed this issue · 10 comments

digitv commented

Hi!
Due to issues with guzzle:
GHSA-25mq-v84q-4j7r
GHSA-q559-8m2m-g699

Please up guzzle/psr7 version constraint to ~2.1 OR ^2.4.0. This allows to instal latest guzzlehttp/guzzle.

timwhitlock commented

I've had endless problems with this and don't want to risk breaking things here. This library uses guzzlehttp/guzzle-services which has caused dependency conflicts in the past, see issue #12.

I've tried your proposed change on master and all is fine in my test env. Can you confirm this works? I don't know enough about this to know if this change will introduce problems for others. Please advise if you do.

digitv commented

As for me, works like a charm and now I could put back roave/security-advisories to composer.json.
So I`m happy 😉.

My env:
PHP 8.1
Laravel 8
with packages by composer show | grep guzzle

guzzlehttp/command           1.2.2   Provides the foundation for building command-based web service clients
guzzlehttp/guzzle            7.4.5   Guzzle is a PHP HTTP client library
guzzlehttp/guzzle-services   1.3.2   Provides an implementation of the Guzzle Command library that uses Guzzle service descriptions to describe web services, serialize requests, and parse responses into easy to use model structures.
guzzlehttp/promises          1.5.1   Guzzle promises library
guzzlehttp/psr7              2.4.0   PSR-7 message implementation that also provides common utility methods
guzzlehttp/uri-template      v1.0.1  A polyfill class for uri_template of PHP
bancer commented

It looks like the fix applied broke things. We cannot update from 2.0.10 to the loco version 2.0.11:

composer update loco/loco:2.0.11 --dry-run -W
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - guzzlehttp/guzzle-services 1.3.1 requires guzzlehttp/guzzle ^7.3 -> found guzzlehttp/guzzle[7.3.0, ..., 7.5.0] but these were not loaded, likely because it conflicts with another require.
    - guzzlehttp/guzzle-services 1.3.2 requires guzzlehttp/guzzle ^7.4.1 -> found guzzlehttp/guzzle[7.4.1, ..., 7.5.0] but these were not loaded, likely because it conflicts with another require.
    - loco/loco 2.0.11 requires guzzlehttp/guzzle-services ~1.3.1 -> satisfiable by guzzlehttp/guzzle-services[1.3.1, 1.3.2].
    - Root composer.json requires loco/loco ^2.0 -> satisfiable by loco/loco[2.0.11].
bancer commented

In my understanding

"guzzlehttp/guzzle-services": "~1.3.1",
"guzzlehttp/psr7": "~2.1|^2.4.0",

should be changed to

"guzzlehttp/guzzle-services": "^1.1",
"guzzlehttp/psr7": "^1.8|^2.1",
timwhitlock commented

Every release gives me problems with this dependency. I get regular requests for tweaks to composer.json which work for individuals, but every time it breaks for someone else.

Please submit a PR for your proposed change and I will merge into master.

bancer commented

Done - #19.

  • 👍1
gemal commented

@timwhitlock any chance for a new release with this fix?

timwhitlock commented

This was a blind fix for me. If all three people on this thread can confirm it works I'll make a release.

gemal commented

we installed the latest dev-master and it worked fine for us

timwhitlock commented

A new release is imminent. Does anyone else on this thread have a problem with the new composer settings?
I'd be grateful if those affected could update master and check. Thanks.