composer / composer/satis

Unused dependencies are not indexed

Open
#650 8 comments 0 reactions 0 assignees View on GitHub
feature
Dominant language
PHP
Stars
3.3k
Forks
530
Avg merge
6h 53m
Merged PRs (30d)
13

Description

**Description**
Suppose we have a root requirement on package A.
Package A has a dependency on package B: "^1.0"
During satis build, package B v1.0 is downloaded and indexed
Later, when B v1.1 is released, the next Satis build will download and index it, but will not index B v1.0 (though dumped package is still here)

If a client has B : v1.0 in its composer.lock, composer install fails.

**Cause**
It seems that dumped packages are merged with new packages only if a filter has been used:

BuildCommand.php around line 200 :
`if ($packageSelection->hasFilterForPackages() || $packageSelection->hasRepositoryFilter()) {`
//merge old packages
`}`
this does not take into account when an old package is no longer required by current root packages.

I can take care of a fix if you agree with my analysis.

**Proposed fixes**

1. Always merge old packages
2. Add a configuration option 'always-merge-old-packages'
3. Try to detect if old packages are orphaned ? (though this one seems much more difficult to implement)

Option 2 seems to me the best choice

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.