dependabot / dependabot/dependabot-core

Composer plaform schema gets overwritten with old version

Open
#10,784 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

L: github:actions L: php:composer T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

composer

### Package manager version

2.8.1

### Language version

PHP

### Manifest location and content before the Dependabot update

In project root

### dependabot.yml content

```yaml
version: 2
updates:
- package-ecosystem: "composer"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "07:00"

ignore:
# Don't raise a separate PR for major drupal updates,
# Skip as we do these manually
# Minor updates will be raised as separate PR
# Only patch updates will be dealt with here
- dependency-name: "drupal/core*"
update-types: ["version-update:semver-major"]

allow:
# Allow both direct and indirect updates for all packages
- dependency-type: "all"
versioning-strategy: lockfile-only

groups:
drupal-core-patches:
patterns:
- "drupal/core*"
update-types:
- "patch"
contrib-module-updates:
patterns:
- "*"
exclude-patterns:
- "drupal/core*"
update-types:
- "minor"
- "patch"

- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "07:00"
```

### Updated dependency

All

### What you expected to see, versus what you actually saw

The plaform section of composer.lock is being changed to the older schema (empty array) and not an object.
I would not expect this section to be updated.

This was noticed as we have a Github action that creates a build using Acquia BLT, which then errors with a dirty repository warning related to this change in composer.lock.

Current workaround is to checkout the dependabot PRs and run composer update --lock and push, which restores the platform schemas.

### Native package manager behavior

Since composer 2.8, the platform and platform-dev sections are objects.
https://github.com/composer/composer/pull/12123

### Images of the diff or a link to the PR, issue, or logs

Screenshot 2024-10-14 at 1 05 56 PM

```
- "platform": {},
- "platform-dev": {},
```
```
+ "platform": [],
+ "platform-dev": [],
```

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the Composer 2.8.1 update with the shown dependabot.yml and compare the composer.lock platform and platform-dev fields before and after the Dependabot run. The work is done when Dependabot no longer changes these fields from objects to arrays and the resulting update PR does not require a manual composer update --lock.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.