| Age | Commit message (Collapse) | Author |
|---|
|
Add an Ignored variant to the advisory enum (renamed to AnySecurityAdvisory)
so the PHP three-class hierarchy PartialSecurityAdvisory -> SecurityAdvisory
-> IgnoredSecurityAdvisory maps one-to-one onto enum variants.
Replace the hard-coded auditor downcasts with as_security_advisory()
(PHP `instanceof SecurityAdvisory`, true for both full and ignored) and
as_ignored(), implementing severity/cve/source ignore filtering, the
toIgnoredAdvisory conversion, and the table/plain row output faithfully.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
Response only ever reads the url out of the request array, so accept it
as a String directly. With url always present the 'url key missing'
LogicException can no longer fire, so Response::new and CurlResponse::new
return Self instead of a double Result. Also drops the unused
from_php_mixed/to_php_mixed stubs and the request_to_map helper.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
Implement the previously stubbed phase-b TODO so getSecurityAdvisories
skips advisories whose affected_versions do not match the requested
package constraint. Share the package VersionParser with
PartialSecurityAdvisory::create across both PackageRepository and
ComposerRepository instead of a separate semver parser instance.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
Change RepositoryInterface and WritableRepositoryInterface read methods
(find_package, find_packages, get_packages, load_packages, search,
get_providers, get_canonical_packages) to take &mut self and return
anyhow::Result, so lazy-loading repositories such as ComposerRepository
can perform fallible I/O and mutate internal state on access. Update all
implementors and call sites to propagate the Result and pass mutable
references.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
Replace the i64 bitmask + encode_with_indent split with a JsonEncodeOptions
struct (Default = JSON_UNESCAPED_SLASHES|JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE,
default indent). encode/write each get a default form plus an explicit
encode_with_options/write_with_options variant, mirroring PHP's optional
$options argument. write_with_options always encodes with self.indent, matching
PHP write().
Also reconcile call sites with the PHP sources: most ported sites passed 0 where
Composer omits the argument (= default flags), so JsonManipulator/ShowCommand and
JsonConfigSource now use the default options; only ComposerRepository and Locker
genuinely pass 0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
Package/CompletePackage/RootPackage
Fill the trait-impl todo!() across the package accessor layer so loaded
packages are actually usable (the ArrayLoader::load path depends on it):
- Package: implement BasePackage/PackageInterface from struct fields and
existing inherent methods; Display via get_unique_name.
- CompletePackage: delegate PackageInterface to inner Package.
- RootPackage: delegate CompletePackageInterface/PackageInterface to inner
CompletePackage; RootPackageInterface link setters delegate to Package.
Correct three unfaithful trait signatures found during implementation:
- get_target_dir returns Option<String> (PHP computes a normalized value;
a borrow cannot represent it, and AliasPackage could not implement &str
across its aliasOf handle).
- RootPackageInterface link setters take IndexMap<String, Link>, matching
Package and the real ArrayLoader caller (PHP RootPackage inherits
Package::setRequires; the Link[] docblock was imprecise).
- get_full_pretty_version takes a DisplayMode enum instead of a raw i64;
the match is now exhaustive, so it returns String without an error path.
Move mirror conversion to the boundaries: PackageInterface mirror methods
use Vec<Mirror> (the typed form, matching the inherent methods), with
array<->Mirror conversion done by the producer (ComposerRepository) and
consumer (ArrayDumper).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
|
Implement the security advisory pool filter end to end, plus the
remaining actionable wirings it unblocked.
- Unify the PartialSecurityAdvisory|SecurityAdvisory union as the
PartialOrFullSecurityAdvisory enum and make the advisory types Clone,
so advisories can be collected and stored; Pool.security_removed_versions
now carries the union. This also unblocks PoolOptimizer's clone of the
security-removed versions.
- Thread the filter result through run_security_advisory_filter/build_pool
as anyhow::Result.
- Introduce typed PlatformRepositoryHandle and pass platform repos as
handles through determine_requirements instead of &PlatformRepository.
- Wire RuleSetGenerator's is_unacceptable_fixed_or_locked_package check
and UpdateCommand's non-locked installed-packages branch.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
|
PHP packages have reference semantics, so introduce shared-ownership
handles over an AnyPackage enum (PackageInterfaceHandle and friends)
and replace Box<dyn PackageInterface> throughout.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
Replace the dyn ConstraintInterface trait objects with an AnyConstraint
enum closing over its four implementors (Simple, Multi, MatchAll,
MatchNone), mirroring the earlier Rule enum conversion. Rename
constraint.rs to simple_constraint.rs to match the renamed Constraint
type.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
Mechanically convert promise-returning function bodies to async/await:
resolve() returns the value directly, forwarding calls get .await, and
simple .then chains become await sequences. Also collapse the installer
double-Option (Result<Option<Option<PhpMixed>>> -> Result<Option<PhpMixed>>).
Hard spots that depend on the Loop::wait / job-machine boundary
(accept/reject orchestration, closures capturing &mut self, batch waits)
are left intact and marked with TODO(phase-c-promise) for manual porting.
The crate does not compile yet; traits still need #[async_trait].
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
|
|
|
Convert Pool to Rc<RefCell<Pool>> so Solver, Decisions, and
RuleSetGenerator share it, resolving the todo!() placeholders that
blocked the dependency resolver (Phase C shared ownership).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
|
|
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
|
|
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
|
|
|
|
|
