Declaring composer package version about shopware HOT 9 CLOSED

@NeoBlack
The current pinning helps us to have a reproduceable build. We have already a ticket open to reconsider it https://issues.shopware.com/issues/NEXT-9961

from shopware.

It's not the same. Shopware has two distributions ways zip version and composer. In the Zip your comment would work. But when somebody depend on Shopware using composer only the require from composer.json will be restrictet.

Locking for a specific version makes the lifes for our support team easier, because we have only to check the Shopware version and not of the dependencies. We had already tickets, where a single patch version difference in Symfony broke the complete shop registration and address managment

from shopware.

@shyim Yes! That is fine. I encourage you to do that, just by the means of the composer.lock file.

• you could do build/test with locked versions
• with downgraded versions
• with latest versions

https://getcomposer.org/doc/01-basic-usage.md#installing-with-composer-lock

from shopware.

I just explained our current point why we do it and didn't said we are against that 😊 .
We will look into that linked issue and come back with feedback 😊

from shopware.

Okay. I see, you have incompetent users.
I am sorry.

from shopware.

where a single patch version difference in Symfony broke

@shyim If you encounter an issue use version exclusion: "symfony/something": "^3.1.41 !=3.1.42"

But I understand the business is the main thing.

from shopware.

pinning the version in the composer.json file is a pain in the ass for the other developers, who code plugins or try to manage bigger installations. It is stupid to pin package versions in a composer product.
Other systems also have zip releases and don't pin packages to a specific version. I guess you don't understand how package management works. Really sad.

from shopware.

That does not help us. This repository is an library and not an root composer project

from shopware.

Okay.
Please randomly pick a handful of Composer packages https://packagist.org/explore/popular
and it will be very-very difficult to find one with locked versions in the JSON file.
How could it be? (theoretical question)

from shopware.