Flex tries to install version that are not tagged

[icanhazstring]

Hi seems like I have found an issue with symfony/flex regarding * version constraint.

Problem:
Having the following requirements:

{
    "require": {
        "php": ">=8.2",
        "symfony/flex": "^2.3.2",
        "symfony/framework-bundle": "~6.3.2",
    }
}

Running the following command will fail as symfony/flex takes the version from symfony/framework-bundle to replace any * version inside the pack.

composer req symfony/serializer-pack

Problem here symfony/property-info does not have a version 6.3.2 so the installation failes.
When I remove symfony/flex and simply require property-info with * everything works fine and version v6.3 is installed.

[nicolas-grekas]

I don't reproduce the issue (but I had to use -W flag, which looks legit to me):
composer req symfony/serializer-pack -W

[icanhazstring]

Let me give you a reproducer, as this still happens.

[icanhazstring]

Here is a minimal composer.json

{
    "name": "icanhazstring/test-symfony",
    "type": "library",
    "require": {
        "symfony/framework-bundle": "^7.2.5",
        "symfony/flex": "^2.5.1"
    },
    "autoload": {
        "psr-4": {
            "icanhazstring\\TestSymfony\\": "src/"
        }
    },
    "config": {
        "allow-plugins": {
            "symfony/flex": true
        }
    },
    "scripts": {
        "auto-scripts": {
            "cache:clear": "symfony-cmd",
            "assets:install %PUBLIC_DIR%": "symfony-cmd"
        }
    }
}

Running the following command will fail, as symfony/flex tries to use the framework-bundle version ^7.2.5 to require any symfony package.

composer req symfony/property-access

Current latest version for property-access is 7.2.3, so running:

composer req symfony/property-access:^7.2.3

will solve the problem.
But this always takes additional work to find out what the latest version of the package in question is.

I don't know if it might make sense for flex, to only use the ^major.minor version of framework bundle, to just match that and let composer install the proper version.

[stof]

using a precise symfony/framework-bundle requirement to guess the version number (done in the PackageResolver of Flex) is indeed bad when the original constraint specify a patch version as lowest bound (common when using composer bump) as Symfony does not guarantee that all packages are tagged for each patch version (to reduce the amount of patch versions for all the unchanged packages).

Leaving the guessing to composer (while applying the SYMFONY_REQUIRE filtering during dependency resolution) is likely to be better thanks to the smart guessing of composer.
Otherwise, that guessing should indeed account for that case.

[nicolas-grekas]

OK got it.
I'm leaning towards closing as won't fix, unless someone wants to dig @stof's proposal?
This doesn't look critical to me.

[icanhazstring]

OK got it.
I'm leaning towards closing as won't fix, unless someone wants to dig @stof's proposal?
This doesn't look critical to me.

That is completely inside symfony/flex? If so I might take a shot at this and create a PR proposal.

[nicolas-grekas]

I think so yes. Would be nice thanks!

[nicolas-grekas]

Let's go with #1049, aka let's ignore the version of framework-bundle.
Composer resolves the version already, and extra.symfony.require should be used anyway if available.

[icanhazstring]

Nice. Thank you 🚀