Skip to content

chore: simplify Composer version constraints - #180

Merged
ManukMinasyan merged 1 commit into
4.xfrom
chore/simplify-composer-constraints
Sep 6, 2026
Merged

chore: simplify Composer version constraints#180
ManukMinasyan merged 1 commit into
4.xfrom
chore/simplify-composer-constraints

Conversation

@ManukMinasyan

Copy link
Copy Markdown
Contributor

Use major.minor caret constraints for Composer dependencies, including filament/filament: ^5.7 instead of ^5.7.8.

This follows the common notation in Spatie's package tools and Filament Support.
Both projects also use patch-specific constraints where needed. Three-part constraints are valid Composer syntax, but they set a more restrictive minimum.

The changes lower development patch minimums while preserving supported major and minor lines. spatie/laravel-package-tools: ^1.15 is equivalent to ^1.15.0.
Runtime compatibility and npm dependencies remain unchanged.

Validation:

  • Composer validation passes; audited installations report zero vulnerabilities.
  • PHP 8.5 / Laravel 13 / Filament 5.7.8: 176 tests pass, with 20,723 assertions.
  • PHP 8.3 / Laravel 12 / Filament 5.7.6: 176 tests pass, with 20,723 assertions.
  • Pint passes. PHPStan reports the same seven existing errors, with no new errors or suppressions.

The broader ^5.7 range also matches older vulnerable patches. Composer blocked the attempted 5.7.0 installation with its existing advisory protection.
The older-version test therefore uses 5.7.6, which contains the MFA security fix. No advisory checks were disabled.

Copilot AI lite review requested due to automatic review settings September 6, 2026 14:23
@ManukMinasyan
ManukMinasyan merged commit fd5f526 into 4.x Sep 6, 2026
9 checks passed

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The relaxed filament/filament: ^5.7 range can resolve to known-vulnerable Filament patches (<5.7.6) without an explicit Composer-level block in this package.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR simplifies Composer dependency version constraints by switching several dependencies from patch-specific caret constraints (e.g. ^5.7.8) to major.minor caret constraints (e.g. ^5.7), aiming to lower minimum patch requirements while keeping the same supported major/minor lines.

Changes:

  • Loosened spatie/laravel-package-tools from ^1.15.0 to ^1.15.
  • Loosened several require-dev constraints (including filament/filament, Pest plugins, PHPStan tooling, Pint, Collision, Ray) to major.minor caret ranges.
File summaries
File Description
composer.json Updates Composer version constraints to be less patch-specific, primarily in require-dev.
Review details
  • Files reviewed: 1/1 changed files
  • Comments generated: 1
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread composer.json
},
"require-dev": {
"filament/filament": "^5.7.8",
"filament/filament": "^5.7",
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants