bug: commande "raise-to-installed" swap suggest part

[94noni]

hey, I've run to test on a project having only a composer.json no .lock and this was swap

[TomasVotruba]

Hi, thanks for reporting 👍

@samsonasik Could you look into this one?

[samsonasik]

@TomasVotruba I will try,

@94noni could you give example of composer.json and step by step to reproduce? Thank you.

[samsonasik]

@94noni I can't reproduce

please provide simple reproducible repository with sample composer.json so it can be fixed, thank you

[TomasVotruba]

@samsonasik I think the same package will be duplicated in "require" section and there should be replaced. But suggest should be skipped

[94noni]

@samsonasik i will try to give you the composer.json I run on without some specific package

[samsonasik]

@TomasVotruba I tried that as well, still can't reproduce, so probably on specific some version syntax

[94noni]

friendly ping @samsonasik
I think I've a reproducer :

• rector/jack (0.2.5)
• composer.json

{
  "name": "foo/bar",
  "description": "Foo Bar",
  "type": "project",
  "license": "proprietary",
  "autoload": {
    "psr-4": {}
  },
  "autoload-dev": {
    "psr-4": {}
  },
  "require": {
    "php": ">=8.4"
  },
  "require-dev": {
    "friendsofsymfony/http-cache-bundle": "^3.0"
  },
  "suggest": {
    "friendsofsymfony/http-cache-bundle": "To use cache management."
  },
  "config": {

  },
  "minimum-stability": "stable",
  "prefer-stable": true
}

• run

vendor/bin/jack raise-to-installed

you will see the composer suggest part updated as well

[samsonasik]

It seems you don't have rector/jack in your composer.json, where you place it, are you run on root project?

[samsonasik]

Ok, I got it updated:

➜  some-project-jack php84 /usr/local/bin/composer require --dev rector/jack:0.2.5 
./composer.json has been updated
Running composer update rector/jack
Loading composer repositories with package information
Updating dependencies
Lock file operations: 1 install, 0 updates, 0 removals
  - Locking rector/jack (0.2.5)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 1 install, 0 updates, 0 removals
  - Installing rector/jack (0.2.5): Extracting archive
Generating autoload files
41 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
No security vulnerability advisories found.

➜  some-project-jack php84 vendor/bin/jack raise-to-installed                     
Analyzing "/vendor/composer/installed.json" for versions

                                                                                                                        
 [OK] 1 package were updated changed to installed versions.                                                             
      Now run "composer update --lock" to update "composer.lock" hash                                                   
                                                                                                                        

 * friendsofsymfony/http-cache-bundle (^3.0 => ^3.2

it probably related that it require php 8.4

[samsonasik]

so, the issue seems on ComposerJsonPackageVersionUpdater::update() which replace multiple times:

jack/src/FileSystem/ComposerJsonPackageVersionUpdater.php

Lines 14 to 20 in 298cb9d

	return Strings::replace(
	$composerJsonContents,
	// find
	sprintf('#"%s": "(.*?)"#', $packageName),
	// replace
	sprintf('"%s": "%s"', $packageName, $newVersion)
	);

I tried update with limit 1 make it works:

        return Strings::replace(
            $composerJsonContents,
            // find
            \sprintf('#"%s": "(.*?)"#', $packageName),
            // replace
            \sprintf('"%s": "%s"', $packageName, $newVersion),

+            1
        );

but that seems can't actually fix it if "suggest" position early, or run multiple times, so propery "inside require" or "inside require-dev" regex is needed to cover it.

[samsonasik]

Ok, I can reproduce via unit test on PR:

• [ComposerProcessor] Skip change under "suggest" config in composer.json for RaiseToInstalledComposerProcessor #27

I will look into it :)