composer warning : the version constraint has no upper bound

1
votes

I have under my composer.json this list of packages:

    "symfony/asset": "*",
    "symfony/console": "*",
    "symfony/expression-language": "*",
    "symfony/flex": "^1.1", // ther's no warning here
    "symfony/form": "*",
    "symfony/framework-bundle": "*",
    "symfony/orm-pack": "*",
    "symfony/process": "*",
    "symfony/security-bundle": "*",
    "symfony/serializer-pack": "*",
    "symfony/translation": "*",
    "symfony/twig-bundle": "*",
    "symfony/validator": "*",
    "symfony/web-link": "*",
    "symfony/yaml": "*",

Unfortunately, after trying validating composer dependencies via composer validate I'm getting this warning:

Unbound version constraints (*) should be avoided.

The version constraint has no upper bound - this is not a good idea.

I found the raison why under the officiel doc https://getcomposer.org/doc/faqs/why-are-unbound-version-constraints-a-bad-idea.md But I have no idea how to fix the warrning.


Any idea how to update automatically (else manually) the "*" to the current installed version, via just some useful composer command lines.
(To define an upper bound on my constraints).

3
symfonycomposer-php
This is a terrible idea to require * in the first place. - emix
@emix, thak you interraction, I think it's the composer behavior after installing dependencies. Any idea how Fix this - famas23
Forgot it's restricted internally. You can ignore this warning as this is not an error. - emix
This might be solved for newer projects with Flex 1.1: github.com/symfony/flex/issues/421 - YetiCGN

3 Answers

2
votes

Any idea how to update automatically (else manually) the "*" to the current installed version, via just some useful composer command lines.

There is no composer command like composer set-version symfony/* 4.2

You need to do this manually.

How did "find and replace" "*" → "^4.2" in *.json files worked for you?


I assume you'd like to use the newest Symfony version - 4.2 at the time being. If you'd like to use the installed one, just run: composer show symfony/asset to find the version.


Btw, don't worry. You have to do this only once a ~2 years :)

1
votes

You are probably missing the extra section from your composer.json that defines which Symfony version to use for dependencies. They changed it for 4.x to not have every package use a version constraint so it's easier to update the whole framework to another version, but at the same time keeping all Symfony components on the same version.

Try adding this to the composer.json file and running composer update:

"extra": {
    "symfony": {
        "require": "^4.2"
    }
}

Edit: Sorry, overlooked that you're using composer validate. Apparently this doesn't take into account the extra definition which is really only a hint for the Flex Composer plugin so it's not recognized by Composer itself.

-1
votes

You may use following command to update it to the latest versions

composer update

But would recommend to have a version specific packages instead of "*", so as to avoid conflict with the future packages