Trim unused packages, remove stale root requires, fix PHP version files (#537)#546
Open
maltehuebner wants to merge 1 commit into
Open
Trim unused packages, remove stale root requires, fix PHP version files (#537)#546maltehuebner wants to merge 1 commit into
maltehuebner wants to merge 1 commit into
Conversation
Reduces dependency surface (symfony/messenger + amqp-messenger were already removed on main in #497): - Drop calderacc/geobasic from require and the inline package repository (no Caldera\GeoBasic usage anywhere in src/config/templates). - Drop symfony/process from require (no Symfony\Component\Process usage; it stays as a transitive dev dependency of symfony/maker-bundle). - Drop the phpstan/phpdoc-parser and phpdocumentor/reflection-docblock root requires. Both are pulled transitively; removing the ^1.2 phpdoc-parser pin lets it resolve to 2.x, which unblocks the PHPStan 2 upgrade tracked in #538. - Set .php-version to 8.5 and update the README to state Symfony 8 / PHP 8.5 (was "Symfony 4 / PHP 7.1"). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Partial implementation of #537 — the safely verifiable dependency cleanup.
Changes
calderacc/geobasicfromrequireand from the inlinerepositoriespackage definition.composer whyshows only the root require; there is noCaldera\GeoBasicusage insrc/,config/ortemplates/(the@calderacc/ GitHub-URL grep hits are unrelated text).symfony/processfromrequire. NoSymfony\Component\Processusage; it remains available as a transitive dev dependency ofsymfony/maker-bundle.phpstan/phpdoc-parserandphpdocumentor/reflection-docblockroot requires. Both are transitive (via reflection-docblock/type-resolver and nelmio/api-doc-bundle respectively). Dropping the^1.2phpdoc-parser pin lets it resolve to2.x, which is a prerequisite for the PHPStan 2 upgrade in [Mittel] Ausstehende Major-Upgrades: PHPUnit 13, PHPStan 2, Rector 2 (Config aktuell wirkungslos), Monolog-Bundle 4, Migrations-Bundle 4, Predis 3, Encore 6, DataTables 2 #538..php-version→8.5(was8.3) and README updated to "Symfony 8 / PHP 8.5" (was "Symfony 4 / PHP 7.1"), aligning.php-version,composer.json(php ^8.5) and the docs.symfony/messenger+symfony/amqp-messengerwere already removed onmain(#497), so that task is done.Deliberately not implemented (deferred, with reasons)
Symfony\...\Psr18Client). This is the security-critical centerpiece (5 open Guzzle/psr7 advisories), but it is boot-critical:bazinga_geocoderobtains its PSR-18 client purely throughphp-httpauto-discovery (no explicithttp_clientinconfig/packages/bazinga_geocoder.yaml), so removingphp-http/guzzle7-adapter/php-http/httplug-bundle/php-http/message, droppingHttplugBundlefrombundles.phpand rewiring the Nominatim factory can only be validated by booting the container and exercising a live reverse/forward geocode. The container cannot be booted in this review environment (the localvendor/lackssymfony/runtime, sobin/console/WebTestCasewill not start), so I could not verify that geocoding and city-guessing still work. Committing this unverified would risk breaking search + city detection in production. TheCityGuessercatch change (Http\Client\Exception\NetworkException→Psr\Http\Client\ClientExceptionInterface) belongs with that swap and is deferred with it.presta/sitemap-bundle: ^4.0@dev→ tagged release,maltehuebner/impress-bundle: dev-main→ tag,mhujer/breadcrumbs-bundlefork → upstream release). Each requires researching/creating upstream tags and verifying Symfony 8 compatibility, which risks breakingcomposer install; left for a focused follow-up.@algolia/autocomplete-js"MISSING" — anpm cidocumentation note, out of scope for this composer-focused PR.Verification
composer validate— OK (only the pre-existing exact-version warning for the breadcrumbs fork)vendor/bin/phpstan analyse --no-progress— No errorsvendor/bin/phpunit --testsuite="Project Test Suite"— OK (121 tests)Refs #537 (partial; leaves the HTTP-stack swap and version-pin hardening open)
🤖 Generated with Claude Code