Repository navigation
fix(ci): audit PHP dependencies and pin the platform PHP to 8.2.35 - #78
Merged
Merged
Conversation
Without config.platform.php, Composer resolved dependencies against whatever PHP ran it, so a lock file written on PHP 8.4 could pick packages that need more than the app's minimum. The pin fixes it at 8.2.35, the PHP 8.2 security release of 2026-10-21; PHP 8.2 is the lowest version Nextcloud 33 supports. composer.lock changes only in content-hash and platform-overrides; no locked package moves. Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>
Nothing in CI checked the PHP dependencies for known security advisories. composer audit --locked checks composer.lock against the advisories Packagist collects from GitHub and FriendsOfPHP, and fails on any advisory or abandoned package. It resolves nothing, so the PHP version plays no part. Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>
require-dev pinned nextcloud/ocp to dev-master, whose stubs now require PHP 8.3 like Nextcloud master itself, so a full composer update failed against the 8.2.35 platform PHP. The stubs now follow stable33, the oldest server the app supports. The psalm workflow replaces the stubs with the server versions it analyses against, so CI is unaffected; in composer.lock only the nextcloud/ocp entry and the hash change. The unit tests load these stubs only when they run without a server checkout. Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>
oleksandr-nc
force-pushed
the
chore/php-8.2-baseline
branch
from
October 22, 2026 09:03
ea46764 to
5f1f508
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nothing in CI checked the PHP dependencies for known security advisories.
Dependencies are audited on every pull request
The psalm workflow now runs
composer audit --locked. It checkscomposer.lockagainst the advisories Packagist collects from GitHub and FriendsOfPHP and fails on any advisory or abandoned package. It resolves nothing, so the PHP version plays no part in whether it passes.The platform PHP is pinned to 8.2.35
Without
config.platform.php, Composer resolved dependencies against whatever PHP ran it, so a lock file written on PHP 8.4 could pick packages that need more than the app's minimum. The pin fixes it at 8.2.35, the PHP 8.2 security release of 2026-10-21, on the lowest PHP version Nextcloud 33 supports. The pin changescomposer.lockonly in its hash and platform fields.The OCP stubs follow Nextcloud 33
require-devpinnednextcloud/ocptodev-master, whose stubs now require PHP 8.3 like Nextcloud master, so under the pin a fullcomposer updatefailed. They now follow stable33, the oldest server the app supports. The psalm workflow replaces the stubs with the server versions it analyses against, so CI is unaffected; incomposer.lockonly thenextcloud/ocpentry and the hash change.🤖 AI (if applicable)