Skip to content

dev #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TatevikGr wants to merge 7 commits into
base: main
Choose a base branch
from
+213 −171
Open

dev #86

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
5d745dd
dev
tatevikg1 May 18, 2026
b97a876
Update openapi.json from web frontend workflow 2026-05-20T11:08:24Z
May 20, 2026
3c9c0e2
Update openapi.json from web frontend workflow 2026-05-23T12:37:01Z
May 23, 2026
f156654
Update openapi.json from web frontend workflow 2026-05-25T11:51:56Z
May 25, 2026
0d3ad9e
Update openapi.json from web frontend workflow 2026-05-25T18:24:11Z
May 25, 2026
8284ff3
Update openapi.json from web frontend workflow 2026-05-26T08:30:11Z
May 26, 2026
8557d0e
Update openapi.json from web frontend workflow 2026-05-29T11:57:02Z
May 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions composer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,11 +47,11 @@
},
"require": {
"php": "^8.1",
"phplist/core": "dev-main",
"phplist/core": "dev-dev",
"symfony/twig-bundle": "^6.4",
"symfony/webpack-encore-bundle": "^2.2",
"symfony/security-bundle": "^6.4",
"tatevikgr/rest-api-client": "dev-main"
"tatevikgr/rest-api-client": "dev-dev"
Comment on lines +50 to +54
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Check composer.json constraints =="
python - <<'PY'
import json
with open("composer.json") as f:
    data = json.load(f)
req = data.get("require", {})
for name in ("phplist/core", "tatevikgr/rest-api-client"):
    print(f"{name}: {req.get(name)}")
PY

echo
echo "== Verify remote branches exist =="
git ls-remote --heads https://github.com/phpList/core.git dev dev-dev main || true
git ls-remote --heads https://github.com/tatevikgr/phplist-api-client.git dev dev-dev main || true

echo
echo "== Verify lockfile pins commits for these packages (if lockfile exists) =="
if [ -f composer.lock ]; then
  python - <<'PY'
import json
with open("composer.lock") as f:
    lock = json.load(f)
pkgs = {p["name"]: p for p in lock.get("packages", [])}
for name in ("phplist/core", "tatevikgr/rest-api-client"):
    p = pkgs.get(name)
    if not p:
        print(f"{name}: NOT FOUND in composer.lock")
        continue
    print(f"{name}: version={p.get('version')} reference={p.get('source',{}).get('reference')}")
PY
else
  echo "composer.lock not found"
fi

Repository: phpList/web-frontend

Length of output: 521

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== composer.json constraints =="
python - <<'PY'
import json
with open("composer.json") as f:
    data = json.load(f)
req = data.get("require", {})
for name in ("phplist/core", "tatevikgr/rest-api-client"):
    print(f"{name}: {req.get(name)}")
PY

echo
echo "== Check composer.lock exists (reproducibility) =="
if [ -f composer.lock ]; then
  echo "composer.lock: present"
else
  echo "composer.lock: MISSING"
fi

echo
echo "== Verify upstream 'dev' branches exist (dev-dev maps to branch 'dev') =="
git ls-remote --heads https://github.com/phpList/core.git dev || true
git ls-remote --heads https://github.com/tatevikgr/phplist-api-client.git dev || true

Repository: phpList/web-frontend

Length of output: 415

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== composer.json constraints =="
python - <<'PY'
import json
with open("composer.json") as f:
    data = json.load(f)
req = data.get("require", {})
for name in ("phplist/core", "tatevikgr/rest-api-client"):
    print(f"{name}: {req.get(name)}")
PY

echo
echo "== Check composer.lock exists (reproducibility) =="
if [ -f composer.lock ]; then
  echo "composer.lock: present"
else
  echo "composer.lock: MISSING"
fi

echo
echo "== Verify upstream 'dev' branches exist (dev-dev maps to branch 'dev') =="
git ls-remote --heads https://github.com/phpList/core.git dev || true
git ls-remote --heads https://github.com/tatevikgr/phplist-api-client.git dev || true

Repository: phpList/web-frontend

Length of output: 415

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== composer.lock reproducibility check =="
test -f composer.lock && echo "composer.lock: present" || echo "composer.lock: MISSING"

echo
echo "== upstream branch check (dev) for floating dev-dev constraints =="
git ls-remote --heads https://github.com/phpList/core.git dev || true
git ls-remote --heads https://github.com/tatevikgr/phplist-api-client.git dev || true

Repository: phpList/web-frontend

Length of output: 309

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== composer.lock reproducibility check =="
test -f composer.lock && echo "composer.lock: present" || echo "composer.lock: MISSING"

echo
echo "== upstream branch check (dev) for floating dev-dev constraints =="
git ls-remote --heads https://github.com/phpList/core.git dev || true
git ls-remote --heads https://github.com/tatevikgr/phplist-api-client.git dev || true

Repository: phpList/web-frontend

Length of output: 309

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== composer.lock reproducibility check =="
test -f composer.lock && echo "composer.lock: present" || echo "composer.lock: MISSING"

echo
echo "== upstream branch check (dev) for floating dev-dev constraints =="
git ls-remote --heads https://github.com/phpList/core.git dev || true
git ls-remote --heads https://github.com/tatevikgr/phplist-api-client.git dev || true

Repository: phpList/web-frontend

Length of output: 309

🏁 Script executed:

#!/bin/bash
set -euo pipefail

test -f composer.lock && echo "composer.lock: present" || echo "composer.lock: MISSING"

git ls-remote --heads https://github.com/phpList/core.git dev || true
git ls-remote --heads https://github.com/tatevikgr/phplist-api-client.git dev || true

Repository: phpList/web-frontend

Length of output: 199

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "composer.lock:"
test -f composer.lock && echo "present" || echo "MISSING"

echo
echo "upstream dev branches:"
git ls-remote --heads https://github.com/phpList/core.git dev || true
git ls-remote --heads https://github.com/tatevikgr/phplist-api-client.git dev || true

Repository: phpList/web-frontend

Length of output: 223

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "composer.lock:"
test -f composer.lock && echo "present" || echo "MISSING"

echo
echo "upstream dev branches:"
git ls-remote --heads https://github.com/phpList/core.git dev || true
git ls-remote --heads https://github.com/tatevikgr/phplist-api-client.git dev || true

echo
echo "composer.json constraints:"
python - <<'PY'
import json
with open("composer.json") as f:
    data = json.load(f)
req = data.get("require", {})
for name in ("phplist/core", "tatevikgr/rest-api-client"):
    print(f"{name}: {req.get(name)}")
PY

Repository: phpList/web-frontend

Length of output: 308

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "composer.lock:"
test -f composer.lock && echo "present" || echo "MISSING"

echo
echo "composer.json constraints:"
python - <<'PY'
import json
with open("composer.json") as f:
    data = json.load(f)
req = data.get("require", {})
for name in ("phplist/core", "tatevikgr/rest-api-client"):
    print(f"{name}: {req.get(name)}")
PY

echo
echo "upstream dev branches (what dev-dev tracks):"
git ls-remote --heads https://github.com/phpList/core.git dev || true
git ls-remote --heads https://github.com/tatevikgr/phplist-api-client.git dev || true

Repository: phpList/web-frontend

Length of output: 330

Pin phplist/core and tatevikgr/rest-api-client to immutable refs (and commit composer.lock)

composer.json sets both phplist/core and tatevikgr/rest-api-client to dev-dev, which tracks the upstream moving dev branches. With composer.lock missing, installs/deploys won’t be reproducible and can drift.

  • Replace dev-dev with a tag/commit reference (immutable).
  • Generate and commit composer.lock so Composer pins exact commit hashes.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@composer.json` around lines 50 - 54, composer.json currently pins
phplist/core and tatevikgr/rest-api-client to the floating alias "dev-dev",
which makes installs non-reproducible; update both entries to an immutable
version (a specific tagged version or a commit reference like "v1.2.3" or
"dev-branch#commit-hash") instead of "dev-dev", then run composer update to
regenerate composer.lock and commit the updated composer.json and the generated
composer.lock so installs use exact resolved package hashes; look for the
package keys "phplist/core" and "tatevikgr/rest-api-client" when making this
change.

},
"require-dev": {
"phpunit/phpunit": "^9.5",
Expand Down
Loading
Loading