dependabot / dependabot/dependabot-core
Composer plaform schema gets overwritten with old version
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
composer
### Package manager version
2.8.1
### Language version
PHP
### Manifest location and content before the Dependabot update
In project root
### dependabot.yml content
```yaml
version: 2
updates:
- package-ecosystem: "composer"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "07:00"
ignore:
# Don't raise a separate PR for major drupal updates,
# Skip as we do these manually
# Minor updates will be raised as separate PR
# Only patch updates will be dealt with here
- dependency-name: "drupal/core*"
update-types: ["version-update:semver-major"]
allow:
# Allow both direct and indirect updates for all packages
- dependency-type: "all"
versioning-strategy: lockfile-only
groups:
drupal-core-patches:
patterns:
- "drupal/core*"
update-types:
- "patch"
contrib-module-updates:
patterns:
- "*"
exclude-patterns:
- "drupal/core*"
update-types:
- "minor"
- "patch"
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "07:00"
```
### Updated dependency
All
### What you expected to see, versus what you actually saw
The plaform section of composer.lock is being changed to the older schema (empty array) and not an object.
I would not expect this section to be updated.
This was noticed as we have a Github action that creates a build using Acquia BLT, which then errors with a dirty repository warning related to this change in composer.lock.
Current workaround is to checkout the dependabot PRs and run composer update --lock and push, which restores the platform schemas.
### Native package manager behavior
Since composer 2.8, the platform and platform-dev sections are objects.
https://github.com/composer/composer/pull/12123
### Images of the diff or a link to the PR, issue, or logs
```
- "platform": {},
- "platform-dev": {},
```
```
+ "platform": [],
+ "platform-dev": [],
```
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the Composer 2.8.1 update with the shown dependabot.yml and compare the composer.lock platform and platform-dev fields before and after the Dependabot run. The work is done when Dependabot no longer changes these fields from objects to arrays and the resulting update PR does not require a manual composer update --lock.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100