Documentation: add warning about Composer 2.3

[jrfnl]

👋🏻 Hiya,

I'm not sure where to add this, but I believe it would be prudent to add a warning somewhere in the documentation about Composer 2.3.

Context

Composer 2.3 drops support for PHP 7.2 and the autoload files generated with Composer 2.3 are no longer compatible with PHP < 7.0.

The problem

A lot of projects which create PHAR files will include the composer autoload files in the PHAR and use them for the autoloading of the files within the PHAR.

If a project does so AND needs their PHAR to be runnable of PHP < 7.0, this will break if Composer 2.3 was used to prepare the files to be boxed up.

As Box itself has a minimum of PHP 7.4 and the PHAR file is often generated via a GH Actions workflow, this can be problematic as Composer 2.3 will be installed by default on PHP 7.2+.

The solution

The solution is quite straight-forward: make sure Composer 2.2 is used to prepare the files to be boxed up.

In GH Actions, this would typically be done like this (specifically the last two lines):

       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
           php-version: 8.0
           extensions: exif, phar, openssl
           ini-values: phar.readonly=Off, error_reporting=-1, display_errors=On, zend.assertions=1
           # Autoload files generated with Composer 2.3 are not compatible with PHP < 7.0.
           tools: composer:2.2

[theofidry]

Hi @jrfnl!

Sorry for the very late reply, I could not check any GitHub related notification for a while.

Since it's Composer itself introducing this limitation, I am wondering if it's worth going against it, especially since the next release of Box will require 8.1. I'm also a bit torn regarding the requirement checker tool if it should really stay to 5.3 or can simply be bumped as well.

I however do like the idea of a warning at generation time that the PHAR minimum PHP version supported may not match the desired one.

[jrfnl]

@theofidry Sorry to hear you'll be dropping support for older PHP versions, but I respect your decision. I'll keep an eye on the releases to make sure projects I'm involved with, which still support PHP < 7.2, will remain on an older version of Box.

[theofidry]

I'm not too happy about it either to be honest.

The main reason is just the amount of work. At the moment the way the requirement checker is built is relying on Composer (and there is the scoping process afterwards as well). But if the dumped scoped requirement checker .requirement-checker does not depend on the Composer autoloader, it would be trivial (from that point) to add back support for down to PHP 5.3.

Getting there though is a significant amount of work and I'm not 100% sure on how to do this neither.