composer dependencies too lax, now requires php 5.5

[jmkgreen]

Because you require zendframework/zend-stdlib: ~2.1 (the ~ being the culprit), we are now seeing version 2.7.3 of zend-stdlib being pulled in which requires php 5.5.

[mvriel]

Given your statement I am going to assume that you include phpDocumentor using composer? If so: you can add a line in your composer.json that limits the version of zend-stdlib. Or, when you do composer update using a machine that does not have PHP 5.5 yet it will use the latest version that is available for that PHP version

[jmkgreen]

Thank you for your quick response. Both your suggests appear to be workarounds (which I will need to investigate as I've not spotted such functions within the composer documentation yet). Surely to commit to PHP 5.3 you need to restrict down the dependencies you require? Or am I misunderstanding something...

[mvriel]

We commit to support at least PHP 5.3 and (at this moment) every version in the 5.x major version above 5.3. This also means that there are people who are using newer ZF components and if we limit ourselves to a 5.3 compatible version of ZF that they cannot include it.

In our composer.lock file we limit ourselves to libraries that are compatible with PHP 5.3 but the composer.lock is not used when you include phpDocumentor in your own composer.json file. In such cases you need to ensure yourself that you have limited libraries to the right version (which happens automatically if you install a library on a limited system; in your case I am assuming that you did a composer require on a system with php 5.5).

If your application must be PHP 5.3 compatible then I recommend adding the following line to your composer.json's require section:

"php": "5.3.*",

This will instruct composer to limit installations to those compatible with PHP 5.3.

Another solution is the one I suggested above: to limit individual components