Refactor: replace jean85/pretty-package-versions with native Composer\InstalledVersions - #1047
Refactor: replace jean85/pretty-package-versions with native Composer\InstalledVersions#1047peter17 wants to merge 1 commit into
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b8ef45f. Configure here.
|
|
||
| if (!$container->hasParameter('env(SENTRY_RELEASE)')) { | ||
| $container->setParameter('env(SENTRY_RELEASE)', PrettyVersions::getRootPackageVersion()->getPrettyVersion()); | ||
| $container->setParameter('env(SENTRY_RELEASE)', InstalledVersions::getRootPackage()['pretty_version']); |
There was a problem hiding this comment.
Dev release version loses commit hash
Medium Severity
PrettyVersions::getPrettyVersion() appended a short commit reference for non-tagged packages (e.g. dev-main@7cd88c8), but InstalledVersions::getRootPackage()['pretty_version'] returns only the branch name. When release and SENTRY_RELEASE are unset, branch-based deploys now share one Sentry release identifier, weakening release tracking and suspect commits.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit b8ef45f. Configure here.
There was a problem hiding this comment.
It is true but I believe it is no relevant in the current context, because it just fetches the root package version as a fallback if there is no SENTRY_RELEASE env variable defined. If it is really an issue, I think we can preserve the previous behavior by using the root package reference when available and appending its short SHA (e.g. dev-main@7cd88c8). That keeps the dependency removal while maintaining unique release identifiers for branch-based deployments.
$rootPackage = InstalledVersions::getRootPackage();
$release = $rootPackage['pretty_version'];
if (
isset($rootPackage['reference'])
&& $rootPackage['reference'] !== null
&& str_starts_with($release, 'dev-')
) {
$release .= '@' . substr($rootPackage['reference'], 0, 7);
}
1 participant
Description
Now that Composer 2 is standard across all supported environments, we can rely on Composer's native
Composer\InstalledVersionsAPI (composer-runtime-api: ^2.0) provided directly by Composer itself.Previously,
jean85/pretty-package-versionsserved as a helpful compatibility layer during the Composer 1 era. With Composer 2 ubiquity, shifting to native Composer runtime APIs allows us to:composer/composer) directly where built-in capabilities exist, minimizing potential supply-chain surface area.composer/package-versions-deprecated).Changes
jean85/pretty-package-versionsdependency with"composer-runtime-api": "^2.0"incomposer.json.SentryExtensionandSentryExtensionTestto useComposer\InstalledVersions::getRootPackage()['pretty_version'].composer.json.Verification
composer cs-checkpassedcomposer tests(PHPUnit suite) passed