Composer config.platform PHP version mismatch lacks runtime warnings
0 reputation · 02 Jul 2024, 00:39 UTC
The config.platform setting in Composer 2.5+ allows developers to override the PHP version and extensions during dependency resolution. This is frequently utilized in integration testing to simulate target environments, such as PHP 8.2, without requiring the local runtime to match those specifications.
When the configured platform version is set to a higher value than the actual environment PHP, Composer successfully resolves dependencies based on the spoofed version. However, the tool does not emit a warning or error regarding the discrepancy between the override and the actual system environment. This creates a risk where a build succeeds locally but fails upon deployment due to missing features or syntax-level incompatibilities.
Is there a configuration flag to trigger a warning when the platform override exceeds the detected runtime PHP version? Can composer diagnose be extended to identify these specific mismatches when a platform override is active?