Update composer.json in order to allow development versions instead to set "minimum-stability"

[phansys]

Update composer.json in order to whitelist (with stability flags) development versions instead to set "minimum-stability".

The problem with the current setup (using "dev" as "minimum-stability"):

• my-project requires package-A:^2.0, which has a stable release;
• users perform composer update
• package-A is resolved to their last available 2 major (stable) version, let's say 2.7.4;
• package-A requires package-B:^1.0, which has a stable release;
• package-B is resolved to their last available 1 major (stable) version, let's say 1.0.0;

---

Until here, everything should be fine, since my-project knows that all the installed packages are stable. Let's see the following:

• in the PATCH version 2.7.5 the package-A decides to change their requirement from package-B:^1.0 to package-B:2.0-dev, which is not a stable release;
• users perform composer update
• package-A is resolved to their last available 2 major (stable) version (2.7.5);
• package-B is resolved to their last available 2 major (unstable) version (2.0-dev);

---

At this point, the users which own the responsibility under my-project were installed silently an unstable version of a package which can potentially break some existing feature or behavior in their project.
With the proposed changes, if the users want to use the 2.7.5 version from package-A, they will be restricted to install the unstable version from package package-B, at least if they decide under their own risk and responsibility to trust on that package, whitelisting it until a stable release will be available from what is required from package-A.

[jcnventura]

Instead of doing a lot of unrelated changes everywhere, including some that introduce errors, please do the simple one/two line change you really want please.

And please explain what is the problem with the current setup.

[jcnventura]

All the above are what webflo/drupal-core-require-dev already does.. Please don't do this.

[phansys]

The whitelist is required in order to avoid unintended burden of the stability with dangerous dev dependencies, so a more narrow decision is to allow explicitly the non stable packages using stability flags.

[jcnventura]

Please revert. It's correct as it is. There is no 8.0 of this project.. There's only 8.x.

[phansys]

8.0 doesn't exist really, it's the implicit SemVer branch alias which points to 8.x-dev.

[phansys]

For those who felt confused about the motivation for these changes, I've added a more detailed example trying to explain how composer works and what my concerns are.

Thank you in advance for your feedback.

[phansys]

IMHO, #512 is a good example of what happen when a package trust on an unstable dependency, and it gets even worse when that dependency is allowed blindly, like in this case.

[AlexSkrypnyk]

This pull request/issue has been inactive for over a year and is being closed due to inactivity. If the issue still persists or the contribution is still relevant, please feel free to reopen it or create a new one.

Thank you for your understanding and your contributions to the project!