Composer dependency resolution issue with scripts

[miguilimzero]

Composer v2.6 release had a dependency resolution regression, as noted here: #11626, and intended to be fixed here: #11629. However, there is still an issue happening with this version of the composer.

I created an example repository to reproduce the issue: https://github.com/miguilimzero/composer-react-promise-bug.

The issue is currently about the resolution of react/promise dependency version from the ccxt/ccxt package. The composer.json and composer.lock are showing the correct version, and when you do the composer install, it will also download the correct version (v2.10 in this case).

But when it runs the post-autoload-dump script, it actually throws an error of wrong function declaration of the PromiseInterface class from react/promise used by ccxt. But the error shows the PromiseInterface from v3.0 and not v2.10, even if the composer.lock and the downloaded package shows the v2.10 version.

You can see by downloading the repository example and doing the composer install that the react/promise version is actually correct, and the PromiseInterface matches with the ccxt implemented one.

You can see a CI from the example repository running on v2.5 (success): https://github.com/miguilimzero/composer-react-promise-bug/actions/runs/6270268972/job/17027972907

You can see a CI from the example repository running on v2.6 (fail): https://github.com/miguilimzero/composer-react-promise-bug/actions/runs/6270268969/job/17027972919

Both runs are from the same commit and show different results.

[Seldaek]

Yes, that is because Composer now ships with react/promise 3.x - so scripts running in the same PHP process have to be compatible with it.

You should run an external binary/php script instead of a static method if you have dependencies which clash with Composer's, that way Composer will run the script in a new process.

[miguilimzero]

@Seldaek Thanks for the explanation! So, from my understanding, any package that requires react/promise ^2 will not work with a script that calls a static method, right?

I made this example repository trying to reproduce how it works with Laravel. The framework calls a static method that requires the autoload file (in the same way as the example) and then clears some cache files. So the ccxt/ccxt package broke with the Composer v2.6 update in any Laravel project.

[Seldaek]

Yes that is correct. Well it's specifically a problem with Laravel because it includes the autoloader, and then with ccxt/ccxt because it does things with the promise interface which are not compatible across both versions. Composer for example is compatible with both react/promise 2.x and 3.x, so it's not like this will cause issues with any project requiring it.

[miguilimzero]

@Seldaek alright. Thanks for the support!