Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Composer: Stability and Semantic Versioning Demystified (PNWPHP 2015)

Beau Simensen
September 11, 2015

Composer: Stability and Semantic Versioning Demystified (PNWPHP 2015)

Understanding stability and semantic versioning makes a huge impact on daily life with Composer. Learn how to decode Composer's solver errors, get a better understanding of semantic versioning, how dependencies interact with each other when it comes to stability, and how to use Composer features like branch aliases to make things run more smoothly.

Beau Simensen

September 11, 2015
Tweet

More Decks by Beau Simensen

Other Decks in Programming

Transcript

  1. { “name”: “acme/my-project”, “description”: “Acme’s My Project”, “license”: “MIT”, “require”:

    { “silex/silex”: “1.1.*” }, “autoload”: { “psr-4”: { “Acme\\MyProject\\”: “src” } } }
  2. $ composer install Loading composer repositories with package information Installing

    dependencies (including require-dev) - Installing psr/log (1.0.0) - Installing symfony/routing (v2.3.7) - Installing symfony/debug (v2.3.7) - Installing symfony/http-foundation (v2.3.7) - Installing symfony/event-dispatcher (v2.3.7) - Installing symfony/http-kernel (v2.3.7) - Installing pimple/pimple (v1.1.0) - Installing silex/silex (v1.1.2) Writing lock file Generating autoload files $
  3. –Semantic Versioning “If the dependency specifications are too tight, you

    are in danger of version lock (the inability to upgrade a package without having to release new versions of every dependent package).”
  4. –Semantic Versioning “If dependencies are specified too loosely, you will

    inevitably be bitten by version promiscuity (assuming compatibility with more future versions than is reasonable).”
  5. { “name”: “silex/silex”, “require”: { “pimple/pimple”: “1.*” } } {

    “name”: “dflydev/doctrine-orm-service-provider”, “require”: { “pimple/pimple”: “~1.1”, “doctrine/orm”: “~2.3” } } 1.1.0 1.1.0 1.1.1 1.0.2 1.0.1 1.0.0 2.0.0 Silex Pimple 0.0.1 2.3.2 2.4.0 2.3.1 2.3.0 2.2.1 2.5.0 ORM 2.2.0 1.0.0 dflydev
  6. { “name”: “acme/myapp”, “require”: { “dflydev/doctrine-orm-service-provider”: “1.0.*”, “silex/silex”: “1.1.*”, “pimple/pimple”:

    “~1.1.1”, “doctrine/orm”: “2.4.*” } } { “name”: “silex/silex”, “require”: { “pimple/pimple”: “1.*” } } { “name”: “dflydev/doctrine-orm-service-provider”, “require”: { “pimple/pimple”: “~1.1”, “doctrine/orm”: “~2.3” } } 1.1.0 1.1.0 1.1.1 1.0.2 1.0.1 1.0.0 2.0.0 Silex Pimple 0.0.1 2.3.2 2.4.0 2.3.1 2.3.0 2.2.1 2.5.0 ORM 2.2.0 1.0.0 dflydev 1.0.0 myapp
  7. $ composer install Loading composer repositories with package information Installing

    dependencies (including require-dev) Your requirements could not be resolved to an installable set of packages. Problem 1 - silex/silex v1.1.0 requires pimple/pimple 1.* -> satisfiable by pimple/pimple[1.0.0, 1.1.x-dev, v1.0.1, v1.0.2, v1.1.0]. - silex/silex v1.1.1 requires pimple/pimple 1.* -> satisfiable by pimple/pimple[1.0.0, 1.1.x-dev, v1.0.1, v1.0.2, v1.1.0]. - silex/silex v1.1.2 requires pimple/pimple ~1.0 -> satisfiable by pimple/pimple[1.0.0, 1.1.x-dev, v1.0.1, v1.0.2, v1.1.0]. - Can only install one of: pimple/pimple[2.0.x-dev, 1.0.0]. - Can only install one of: pimple/pimple[2.0.x-dev, 1.1.x-dev]. - Can only install one of: pimple/pimple[v1.0.1, 2.0.x-dev]. - Can only install one of: pimple/pimple[v1.0.2, 2.0.x-dev]. - Can only install one of: pimple/pimple[v1.1.0, 2.0.x-dev]. - Installation request for pimple/pimple 2.0.*@dev -> satisfiable by pimple/pimple[2.0.x-dev]. - Installation request for silex/silex 1.1.* -> satisfiable by silex/silex[v1.1.0, v1.1.1, v1.1.2]. Potential causes: - A typo in the package name - The package is not available in a stable-enough version according to your minimum-stability setting.
  8. { “name”: “acme/myapp”, “require”: { “naughty/id-generator”: “1.0.*” } } {

    “name”: “naughty/id-generator”, “require”: { “ircmaxell/random-lib”: “dev-master” } }
  9. { “name”: “acme/myapp”, “require”: { “naughty/id-generator”: “1.0.*”, “ircmaxell/random-lib”: “@dev” }

    } { “name”: “naughty/id-generator”, “require”: { “ircmaxell/random-lib”: “dev-master” } }
  10. { “name”: “acme/myapp”, “require”: { “naughty/id-generator”: “1.0.*”, “ircmaxell/random-lib”: “dev-master” }

    } { “name”: “naughty/id-generator”, “require”: { “ircmaxell/random-lib”: “dev-master” } }
  11. { “name”: “acme/myapp”, “require”: { “naughty/id-generator”: “1.0.*”, "dflydev/hawk": "1.0.*", "ircmaxell/random-lib":

    "dev-master" } } { “name”: “naughty/id-generator”, “require”: { “ircmaxell/random-lib”: “dev-master” } } { “name”: “dflydev/hawk”, “require”: { “ircmaxell/random-lib”: “~1.0@dev” } }
  12. { “name”: “acme/myapp”, “require”: { “naughty/id-generator”: "1.0.*”, "dflydev/hawk": "1.0.*", "ircmaxell/random-lib":

    "dev-master" } } { “name”: “naughty/id-generator”, “require”: { “ircmaxell/random-lib”: “dev-master” } } { “name”: “dflydev/hawk”, “require”: { “ircmaxell/random-lib”: “~1.0@dev” } } 1.0.x-dev != dev-master
  13. { “name”: “acme/myapp”, “require”: { “naughty/id-generator”: “1.0.*”, "dflydev/hawk": "1.0.*", "ircmaxell/random-lib":

    "@dev" } } { “name”: “naughty/id-generator”, “require”: { “ircmaxell/random-lib”: “~1.0@dev” } } { “name”: “dflydev/hawk”, “require”: { “ircmaxell/random-lib”: “~1.0@dev” } } Time to send a pull request!
  14. Send pull requests when you find a package that requires

    dev-master when a branch alias exists
  15. –Michael Dowling “I'm working on a new version of Guzzle.

    If you're using composer: stop using dev-master. Use a tagged release. Especially in production.” https://twitter.com/mtdowling/status/440901351657054208
  16. $ composer install Loading composer repositories with package information Installing

    dependencies (including require-dev) Your requirements could not be resolved to an installable set of packages. Problem 1 - The requested package sculpin/sculpin 2.0.* could not be found. Potential causes: - A typo in the package name - The package is not available in a stable-enough version according to your minimum-stability setting
  17. $ composer install Loading composer repositories with package information Installing

    dependencies (including require-dev) Your requirements could not be resolved to an installable set of packages. Problem 1 - The requested package sculpin/sculpin 2.0.* could not be found. Potential causes: - A typo in the package name - The package is not available in a stable-enough version according to your minimum-stability setting
  18. Even if your package requires a dependency @dev, users of

    your package won't get it unless they explicitly ask for it.
  19. { “name”: “silex/silex”, “require”: { “pimple/pimple”: “1.*@dev” } } {

    “name”: “dflydev/doctrine-orm-service-provider”, “require”: { “pimple/pimple”: “1.*@beta”, “silex/silex”: “1.1.*”, “doctrine/orm”: “~2.3” } } Root Package
  20. { “require”: { “dflydev/doctrine-orm-service-provider”: “1.0.*”, “pimple/pimple”: “1.*@alpha” } } {

    “name”: “silex/silex”, “require”: { “pimple/pimple”: “1.*@dev” } } { “name”: “dflydev/doctrine-orm-service-provider”, “require”: { “pimple/pimple”: “1.*@beta”, “silex/silex”: “1.1.*”, “doctrine/orm”: “~2.3” } } Root Package