References to Zend Version 2.3.8p2 about laminas-filter HOT 12 CLOSED

No, I tried a number of different combinations but the latest version I can get composer to install is 2.3.8 (or 2.3.8p2)

The project where you execute composer install/update/whatever is always in power of controlling what composer will do. There is no way that any vendor package can lock you that hard.
This means, if you add to your projects composer.json the following line, the package which pins you to v2.3.8 wont even realize as you force composer to treat v2.9.4 as v2.3.8.

{
    "require": {
        "laminas/laminas-filter": "2.9.4 as 2.3.8"
    }
}

As laminas is quite strict with BC breaks, you should be more than fine by using this alias until you can get rid of that package which holds you back. And TBH: I would focus on removing such a package as you can't even install security-related fixes in case your project would be vulnerable. Thats a no-go and thus you should try to remove that package.

from laminas-filter.

Unsure about this one: it is true that this sounds like a bug in the migration tool that generated the package, but is 2.3.x really to be still supported at all?

(The reason why there is no target branch is because that release was generated from an EOL version of ZendFramework too).

Any reason not to upgrade to more contemporary releases?

from laminas-filter.

Unfortunately, for one specific project I have some dependencies that have not been updated and are restricting me to v 2.3.8

@weierophinney asked me to create an issue for this.

from laminas-filter.

Do we know which symbols are affected/referenced, and whether this is only for the 2.3.8* releases, or if there are there other releases with this problem?

I don't see a massive issue with fixing those too, but it needs work and extreme care, since we're changing old-old-old-old-oldstable software here

from laminas-filter.

Unfortunately, for one specific project I have some dependencies that have not been updated and are restricting me to v 2.3.8

Hm, can't you just use "2.9.4 as 2.3.8p2" as constraint?

from laminas-filter.

Hm, can't you just use "2.9.4 as 2.3.8p2" as constraint?

I even wonder why 2.3.8p2 would be okay if the dependency is locked to 2.3.8. As far is I remember, semver wont accept p2 in that case.

from laminas-filter.

I even wonder why 2.3.8p2 would be okay if the dependency is locked to 2.3.8. As far is I remember, semver wont accept p2 in that case.

Maybe the constraint is <2.3.9 🤷‍♂️
Anyways, such a version constraint seems fishy. I'd rather get rid of that package somehow (cloning or something, if legally allowed) than trying to fix a release from May 2015(!)

Do we know which symbols are affected/referenced, and whether this is only for the 2.3.8* releases, or if there are there other releases with this problem?

Clicking around in different tags in the src/AbstractFilter.php file, it seems that all tags from 2.3.5 including p1 and p2 up until 2.3.9 are affected. Interestingly, 2.3.4 has a Laminas namespace.
2.4.0p1 and p2 are Laminas, rc1 and rc2 have a Zend namespace. Very weird.
Releases later than that are all Laminas namespaced (at least I didn't find a Zend one).

from laminas-filter.

Hm, can't you just use "2.9.4 as 2.3.8p2" as constraint?

No, I tried a number of different combinations but the latest version I can get composer to install is 2.3.8 (or 2.3.8p2)

I even wonder why 2.3.8p2 would be okay if the dependency is locked to 2.3.8. As far is I remember, semver wont accept p2 in that case.

The constraint is 2.3.8 but composer does not care about the "p2". I had the same constraint on laminas-view but since 2.3.8 had the same issues (referencing Zend instead of Laminas) and 2.3.8p2 did not, I ended up using the latter. Hence I looked at laminas-filter 2.3.8p2. Otherwise I do not care about the "p2".

from laminas-filter.

@romanhandke

Due to dependency issues I can not yet upgrade to a newer version beyond 2.3.8(p2).
…
Unfortunately, for one specific project I have some dependencies that have not been updated…

Can you name these dependencies exactly? Are these external packages or Zend Framework / Laminas components.
At the moment we do not know where your concrete problem lies. And before we change very old code, we should try to find out if we can help you differently.

from laminas-filter.

@romanhandke Did you tried my latest suggestion? If that works out, please consider closing this issue as I dont think that we gonna spend time in fixing releases which are 5 years old.

from laminas-filter.

I'll get a 2.3.8p3 issued shortly; honestly, I'm a bit surprised there are still references, considering we already had to do 2 patch releases. ☹️

Once released, use the constraint ~2.3.8.0; that will get the latest patch version. I'll drop a note here when it's available.

from laminas-filter.

2.3.8p3 has been tagged and pushed.

from laminas-filter.