Update dependencies for PHAR distribution of PHPUnit 9.6

[nikic]

Q	A
PHPUnit version	9.6.16
PHP version	7.4.21
Installation Method	PHAR

Summary

Based on the composer.lock file in the phar, it currently contains phpdocumentor/type-resolver version 1.6.1, which is quite old (predating the release date of PHPUnit 9.6.16 significantly). In particular, it does not contain the fix for PHP-Parser 5 compatibility in phpDocumentor/TypeResolver#197, which is part of 1.7.4. This caused a good bit of confusion over in nikic/PHP-Parser#981, because an error was only reproducible with the phpunit phar release, but not the composer dev dependency.

Is it possible to update this dependency? It's not really obvious to me how this version is determined, because the composer.lock in the phar doesn't seem to match https://github.com/sebastianbergmann/phpunit/blob/9.6/composer.lock at all (that one does not contain phpdocumentor/type-resolver in the first place).

[llaville]

Hello @sebastianbergmann

As author of nikic/PHP-Parser#981, I approve this request, especially because it has also an impact on GitHub Action shivammathur/setup-php@v2.

This action uses the PHAR version of PHPUnit (see https://github.com/shivammathur/setup-php/blob/v2/dist/index.js#L969)

So, when we run a workflow with such declaration :

      uses: shivammathur/setup-php@v2
        with:
          php-version: 7.4
          tools: phpunit:9.6

We've got trouble ! For example : https://github.com/composer-unused/symbol-parser/actions/runs/7990344120/job/21818955371#step:5:15

Workaround, as suggested Nikita, is to use the vendor/bin/phpunit (installed with Composer).

And it's works ! See https://github.com/composer-unused/symbol-parser/actions/runs/7996055440

[sebastianbergmann]

It's not really obvious to me how this version is determined, because the composer.lock in the phar doesn't seem to match

With PHPUnit 9.6, the composer.lock file that is in the 9.6 branch of this repository is not used to build phpunit.phar. When building the PHAR, additional packages are installed, which results in a modified composer.lock file. It is this modified composer.lock file that you see when you introspect the PHAR like so:

$ wget https://phar.phpunit.de/phpunit-9.6.phar
$ php phpunit-9.6.phar --composer-lock

For backward compatibility, the PHAR build process for PHPUnit 9.6 installs phpspec/prophecy with version constraint ^1.12.1. This depends on phpdocumentor/reflection-docblock which in turn depends on phpdocumentor/type-resolver.

Is it possible to update this dependency?

I do not know how. Let me explain:

PHPUnit's composer.json file on the 9.6 branch uses

"config": {
    "platform": {
        "php": "7.3.0"

to make sure that no package which requires a version of PHP that is newer than PHP 7.3.0 can be installed regardless of the actual PHP version that is used to build the PHAR, for instance. This leads to version 1.6.1 of phpdocumentor/type-resolver to be installed. When I change "php": "7.3.0" to "php": "8.3.0" in the above, then the PHAR build process uses version 1.8.1 of phpdocumentor/type-resolver.

This is due to the fact that version 1.6.1 of phpdocumentor/type-resolver uses the "php": "^7.2 || ^8.0" version constraint where version 1.8.1 of phpdocumentor/type-resolver uses the "php": "^7.4 || ^8.0" version constraint.

The only solution for this problem that I can see is a version of phpdocumentor/type-resolver that has phpDocumentor/TypeResolver#197 and can be installed with PHP 7.3.

[jrfnl]

@jaapio Any chance of TypeResolver supporting PHP 7.3 ?

[nikic]

@sebastianbergmann Thank you the detailed explanation!

The easiest solution would probably be to release a 1.6.2 version of phpdocumentor/type-resolver with that patch cherry-picked. But maybe this isn't worth the bother, given that using phpunit as a dev dependency avoids the problem.

[jaapio]

I think we can fix that quite easy, will investigate that tomorrow and create a new release 1.6.2

[jaapio]

I managed to have a look today, what would be the easiest way for me to validate this issue is solved before I create a new release? The new release will be based on 1.8.1 and has support for php 7.3 I cannot go lower without to many changed.

[sebastianbergmann]

what would be the easiest way for me to validate this issue is solved before I create a new release?

I do not how this could be validated before the release. Once that release has been made, you can use ant phar on PHPUnit's 9.6 branch. This should then use the new release.

[jaapio]

Ok, will give it a try

[sebastianbergmann]

will investigate that tomorrow and create a new release 1.6.2

1.6.2 was already tagged in October 2022. We are talking about 1.6.3 as the new version here, right?

[nikic]

Oh, that's tricky. I didn't realize that the PHP 7.4 requirement was added in 1.6.2, rather than 1.7.0. In that case the version would have to be something like 1.6.1-p1 I think? (Based on looking at https://getcomposer.org/doc/04-schema.md#version, though it's not explicit about how the versions sort there).