From 2012cf76be7c9bf359ab4fcf3ac3e3c0ba9797cb Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Tue, 3 Nov 2026 17:45:52 +0530 Subject: [PATCH] ci: ignore the blocked symfony/yaml and guzzle versions in composer update Composer 2.11 refuses symfony/yaml 4.4, guzzlehttp/psr7 1.x and guzzlehttp/guzzle 7.8 because of security advisories, so every develop and PR build fails at "Install dependencies". Ignore exactly these packages at these versions, only for the composer update path in CI, until they are upgraded. The committed composer.json and lock, and the master/tag builds from the lock, are unchanged. --- .github/workflows/test_and_build.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/test_and_build.yml b/.github/workflows/test_and_build.yml index f8fce960..71626010 100644 --- a/.github/workflows/test_and_build.yml +++ b/.github/workflows/test_and_build.yml @@ -7,6 +7,13 @@ on: name: Test 👨‍🔧 +env: + # CI only, for `composer update` of the cloned core (develop and PRs): Composer blocks these versions for security advisories. Remove after the symfony/yaml and guzzlehttp/psr7 upgrade. + ADVISORY_IGNORE: >- + {"symfony/yaml": {"constraint": "4.4.*", "reason": "pinned by core and behat/behat 3.8.1", "on-audit": false}, + "guzzlehttp/psr7": {"constraint": "1.9.*", "reason": "required by acmephp/core 1.3.0", "on-audit": false}, + "guzzlehttp/guzzle": {"constraint": "7.8.*", "reason": "last guzzle 7 line that accepts guzzlehttp/psr7 1.x", "on-audit": false}} + jobs: test: #---------------------------------------------------------------------- @@ -69,6 +76,7 @@ jobs: composer install --prefer-dist --no-progress --no-interaction else sed -i 's/\(easyengine\/.*\):\ \".*\"/\1:\ \"dev-develop\"/' composer.json + composer config --json --merge policy.advisories.ignore "$ADVISORY_IGNORE" composer update --prefer-dist --no-progress --no-interaction fi composer dump-autoload --no-dev