Declaring composer package version

[szepeviktor]

I know you have reason/s for putting package versions into composer.json but that prevents updates. https://github.com/shopware/platform/blob/master/composer.json

We could declare package versions in composer.lock

[shyim]

It's not the same. Shopware has two distributions ways zip version and composer. In the Zip your comment would work. But when somebody depend on Shopware using composer only the require from composer.json will be restrictet.

Locking for a specific version makes the lifes for our support team easier, because we have only to check the Shopware version and not of the dependencies. We had already tickets, where a single patch version difference in Symfony broke the complete shop registration and address managment

[szepeviktor]

Okay. I see, you have incompetent users.
I am sorry.

[szepeviktor]

where a single patch version difference in Symfony broke

@shyim If you encounter an issue use version exclusion: "symfony/something": "^3.1.41 !=3.1.42"

But I understand the business is the main thing.

[NeoBlack]

pinning the version in the composer.json file is a pain in the ass for the other developers, who code plugins or try to manage bigger installations. It is stupid to pin package versions in a composer product.
Other systems also have zip releases and don't pin packages to a specific version. I guess you don't understand how package management works. Really sad.

[shyim]

@NeoBlack
The current pinning helps us to have a reproduceable build. We have already a ticket open to reconsider it https://issues.shopware.com/issues/NEXT-9961

[szepeviktor]

@shyim Yes! That is fine. I encourage you to do that, just by the means of the composer.lock file.

• you could do build/test with locked versions
• with downgraded versions
• with latest versions

https://getcomposer.org/doc/01-basic-usage.md#installing-with-composer-lock

[shyim]

That does not help us. This repository is an library and not an root composer project

[szepeviktor]

Okay.
Please randomly pick a handful of Composer packages https://packagist.org/explore/popular
and it will be very-very difficult to find one with locked versions in the JSON file.
How could it be? (theoretical question)

[shyim]

I just explained our current point why we do it and didn't said we are against that 😊 .
We will look into that linked issue and come back with feedback 😊