Broken composer package in 5.2.0

[fliespl]

Describe the bug

Cannot install additional package with zipped file.

I know that composer packages are preinstalled, but adding new package was working just fine with version 5.1.1.

To Reproduce

Steps to reproduce the behavior:

wget -q -c https://files.phpmyadmin.net/phpMyAdmin/5.2.0/phpMyAdmin-5.2.0-english.tar.gz -O - | tar -xz --strip-components 1
composer install / composer require some-package

Expected behavior

Successful install of package.

What happens

composer fails with:

composer install
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. It is recommended that you run `composer update` or `composer update <package name>`.
Your lock file does not contain a compatible set of packages. Please run composer update.

  Problem 1
    - phpmyadmin/phpmyadmin is present at version 1.0.0+no-version-set and cannot be modified by Composer
    - roave/security-advisories dev-latest conflicts with phpmyadmin/phpmyadmin <5.1.3.
    - roave/security-advisories is locked to version dev-latest and an update of this package was not requested.

What I think is happening - composer.json is missing explicit version declaration.

Yeap, explicitly adding "version": "5.2.0" to composer.json worked.

Probably worth rethinking zip strategy?

[williamdes]

Hi @fliespl

This is a duplicate of #17570 in some way. Maybe the release script should write also the version in composer.json for non composer project users.

This is all because of Roave/SecurityAdvisories#76

[fliespl]

Thanks, I am not sure how I missed that ticket :)

I do believe adding version tag is the way to go, cause every package that will set "conflicts" with mention to phpmyadmin would cause such issue.

[williamdes]

@MauricioFauth @ibennetch does it seem okay to you to set at release time the version, or keep it written all the time like package.json has?

[michacassola]

Installing with composer this still happens to me. So I have to do now:

composer -d/var/www create-project phpmyadmin/phpmyadmin --no-dev /var/www/pma
pma_version=$(yq .version /var/www/pma/package.json)
composer -d/var/www/pma config version "$pma_version"
composer -d/var/www/pma update

[williamdes]

Installing with composer this still happens to me. So I have to do now:

composer -d/var/www create-project phpmyadmin/phpmyadmin --no-dev /var/www/pma
pma_version=$(yq .version /var/www/pma/package.json)
composer -d/var/www/pma config version "$pma_version"
composer -d/var/www/pma update

Yes, it still happens until 5.2.1 is out, you can subscribe to #17830