From 2dad0ff6747b80b6fcc4471e7c10d88cb82a4e6a Mon Sep 17 00:00:00 2001 From: Conduction Release Bot Date: Mon, 31 Aug 2026 12:12:47 +0200 Subject: [PATCH] fix(composer): declare ext-xsl so dependabot can resolve Dependabot cannot propose composer updates for this app. Its updater fails with: Your requirements could not be resolved to an installable set of packages. - edgedesign/phpqa[v1.27.0, ..., v1.27.2] require ext-xsl * -> it is missing from your system. config.platform pins php 8.3 so composer resolves against a known PHP version, but says nothing about extensions. edgedesign/phpqa requires ext-xsl and the resolving environment does not have it, so the resolve fails before any bump can be computed. CI is unaffected, which is why this went unnoticed: composer install replays the committed lock and never re-resolves, so the pipeline stays green while dependabot -- which does re-resolve -- fails every time. The shared quality.yml installs no xsl extension anywhere and never invokes phpqa. Declaring ext-xsl beside the php pin makes resolution assume exactly what the committed lockfile already assumes. Verified in a clean composer:2 container without --ignore-platform-reqs: the same file fails without this line and resolves (103 installs, lock written) with it. --- composer.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 679e61ab..9e45b751 100644 --- a/composer.json +++ b/composer.json @@ -104,7 +104,8 @@ "optimize-autoloader": true, "sort-packages": true, "platform": { - "php": "8.3" + "php": "8.3", + "ext-xsl": "1" } } }