Composer versions for required modules are not restrictive enough

[oddnoc]

Consider the required modules at tag 3.3.3:

"require": {
    "php": ">=5.3.3",
    "composer/installers": "*",
    "silverstripe/framework": "~3.3",
    "silverstripe/reports": "~3.3",
    "silverstripe/siteconfig": "~3.3"
},

Doing a composer update today brings in silverstripe/reports 3.4.1 and silverstripe/siteconfig 3.4.1. Unless this is intentional, the version constraints should be changed to "~3.3.0". This will allow the patch level to increase, but will keep the minor revision in sync with cms and framework.

Version 3.4.x of the CMS will run into this problem as soon as 3.5.0 is created.

I want to make sure this is actually a mistake/bug before proposing any patches. Thanks!

[dhensby]

I believe this is as intended.

We implement semver and so this should technically work with any 3.x version of those modules.

Being flexible here allows other modules to be more strict and provides flexibility with compatibility with other modules.

You can always lock down your versions in your composer.json if it's a concern to you

[lerni]

@oddnoc this one keeps latest of 3.3 "3.3.*@stable"

[dhensby]

So does ~3.3.0