Running a recipe on dev-master branch generates a version of 9999999.9999999 in lock file

[pullthefuse]

When installing a package it sets the version correctly as "dev-master" but after running the recipe it changes the version to "9999999.9999999" which then throws an error on a cache:clear.

"thedrum-developers/production-bundle": {
        "version": "9999999.9999999",
        "recipe": {
            "repo": "gitlab.com/thedrum-developers/recipes",
            "branch": "master",
            "version": "dev-master",
            "ref": "091baa18e93cc037058429db21ce6b3d7dc82ca4"
        },
        "files": [
            "config/packages/prod/the_drum_production.yaml"
        ]
    }

I am using private repositories so I am setting the repository in composer.json as below and then running composer require thedrum-developers/production-bundle:dev-master This installs the bundle correctly.

{
    "type": "vcs",
    "url": "git@gitlab.com:thedrum-developers/production-bundle.git"
}

After running the recipes:install thedrum-developers/production-bundle the issue appears.

[nicolas-grekas]

Which error?
Are you able to reproduce with only public recipes + public repo?
If yes, can you share a reproducer?

[javiereguiluz]

I'm seeing this error when trying to upgrade some project to Symfony 7.1:

❯ composer update -vvv

Running 2.7.6 (2024-05-04 23:03:15) with PHP 8.3.7 on Darwin / 23.4.0
Reading ./composer.json
[...]

> pre-pool-create: Symfony\Flex\Flex->truncatePackages
[...]
Restricting packages listed in "symfony/symfony" to "7.1.*"
Built pool.
Running pool optimizer.
Pool optimizer completed in 0.093 seconds
Found 4,349 package versions referenced in your dependency graph. 3,628 (83%) were optimized away.
Updating dependencies
Generating rules
Resolving dependencies through SAT
Looking at all rules.
Something's changed, looking at all rules again (pass #1)
Dependency resolution completed in 0.003 seconds
Analyzed 721 packages to resolve dependencies
Analyzed 4156 rules to resolve dependencies
Nothing to modify in lock file
Generating rules
Resolving dependencies through SAT
Looking at all rules.

Dependency resolution completed in 0.000 seconds
Installing dependencies from lock file (including require-dev)
> pre-operations-exec: Symfony\Flex\Flex->recordOperations

In VersionParser.php line 186:

  [UnexpectedValueException]
  Invalid version string "9999999.9999999"

Exception trace:
  at phar:///usr/local/bin/composer/vendor/composer/semver/src/VersionParser.php:186
 Composer\Semver\VersionParser->normalize() at <my project>/vendor/symfony/flex/src/Flex.php:394
 Symfony\Flex\Flex->recordOperations() at phar:///usr/local/bin/composer/src/Composer/EventDispatcher/EventDispatcher.php:215
 Composer\EventDispatcher\EventDispatcher->doDispatch() at phar:///usr/local/bin/composer/src/Composer/EventDispatcher/EventDispatcher.php:168
 Composer\EventDispatcher\EventDispatcher->dispatchInstallerEvent() at phar:///usr/local/bin/composer/src/Composer/Installer.php:789
 Composer\Installer->doInstall() at phar:///usr/local/bin/composer/src/Composer/Installer.php:652
 Composer\Installer->doUpdate() at phar:///usr/local/bin/composer/src/Composer/Installer.php:298
 Composer\Installer->run() at phar:///usr/local/bin/composer/src/Composer/Command/UpdateCommand.php:251
 Composer\Command\UpdateCommand->execute() at phar:///usr/local/bin/composer/vendor/symfony/console/Command/Command.php:298
 Symfony\Component\Console\Command\Command->run() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:1040
 Symfony\Component\Console\Application->doRunCommand() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:301
 Symfony\Component\Console\Application->doRun() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:394
 Composer\Console\Application->doRun() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:171
 Symfony\Component\Console\Application->run() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:148
 Composer\Console\Application->run() at phar:///usr/local/bin/composer/bin/composer:93
 require() at /usr/local/bin/composer:29

[stof]

Investigating this, it looks like the loading of the symfony.lock expects the package version to be a normalizable package version. But the code writing the lock file in

flex/src/Downloader.php

Lines 196 to 205 in 4dc1191

	$version = explode('.', preg_replace('/^dev-|^v|\.x-dev$|-dev$/', '', $version));
	$version = $version[0].'.'.($version[1] ?? '9999999');
	foreach (array_reverse($recipeVersions) as $v => $endpoint) {
	if (version_compare($version, $v, '<')) {
	continue;
	}
	$data['locks'][$package->getName()]['version'] = $version;
	$data['locks'][$package->getName()]['recipe']['version'] = $v;

overrides the $version variable to be in its own format comparable to recipe version before writing it. I think this variable override is the root cause of this issue (to fully fix the issue, we would have to implement a way to recover from impacted symfony.lock files though). I think it should write the original version for the package version.

[nicolas-grekas]

Anyone up to submit a patch?