From 93733a249437e63774ac1989e0544b2d422e13b3 Mon Sep 17 00:00:00 2001
From: nsfisis <nsfisis@gmail.com>
Date: Fri, 24 Jul 2026 20:23:01 +0900
Subject: fix(pool-builder): use plain getPackages() on locked repository

PoolBuilder::build_pool() and warn_about_non_matching_update_allow_list()
called get_canonical_packages() on the locked repository during a
partial update, but PHP's PoolBuilder uses the plain getPackages().
get_canonical_packages() unwraps AliasPackage down to its base package,
discarding the alias's own version identity.

Locker::get_locked_repository() wraps a lock entry with
extra.branch-alias in a single CompleteAliasPackage rather than adding
a separate base object, so canonicalizing it silently dropped the
locked branch-alias version (e.g. 2.2.x-dev), leaving only the raw
dev-master version behind. For a package excluded from the partial
update's allow-list, that meant its locked branch-alias version could
no longer satisfy the root's constraint, producing a spurious solver
conflict instead of keeping the package pinned exactly as locked.

Fixed the same bug in AuditCommand's --locked package listing, which
had the identical get_canonical_packages()/getPackages() mismatch
against AuditCommand.php.
---
 crates/shirabe/src/command/audit_command.rs            | 3 +--
 crates/shirabe/src/dependency_resolver/pool_builder.rs | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)

(limited to 'crates/shirabe/src')

diff --git a/crates/shirabe/src/command/audit_command.rs b/crates/shirabe/src/command/audit_command.rs
index fb56169e..c797eef1 100644
--- a/crates/shirabe/src/command/audit_command.rs
+++ b/crates/shirabe/src/command/audit_command.rs
@@ -8,7 +8,6 @@ use crate::command::base_command::base_command_initialize;
 use crate::composer::PartialComposerHandle;
 use crate::console::input::InputOption;
 use crate::io::IOInterfaceImmutable;
-use crate::repository::CanonicalPackagesTrait;
 use crate::repository::InstalledRepository;
 use crate::repository::RepositoryInterface;
 use crate::repository::RepositorySet;
@@ -265,7 +264,7 @@ impl AuditCommand {
                     .as_bool()
                     .unwrap_or(false),
             )?;
-            return locked_repo.borrow_mut().get_canonical_packages();
+            return locked_repo.borrow_mut().get_packages();
         }
 
         let root_pkg = composer.get_package();
diff --git a/crates/shirabe/src/dependency_resolver/pool_builder.rs b/crates/shirabe/src/dependency_resolver/pool_builder.rs
index 00d6b938..15cac540 100644
--- a/crates/shirabe/src/dependency_resolver/pool_builder.rs
+++ b/crates/shirabe/src/dependency_resolver/pool_builder.rs
@@ -14,8 +14,8 @@ use crate::package::CompleteAliasPackageHandle;
 use crate::package::PackageInterfaceHandle;
 use crate::package::base_package;
 use crate::package::version::StabilityFilter;
-use crate::repository::CanonicalPackagesTrait;
 use crate::repository::PlatformRepository;
+use crate::repository::RepositoryInterface;
 use crate::repository::RepositoryInterfaceHandle;
 use crate::repository::RootPackageRepository;
 use indexmap::IndexMap;
@@ -159,7 +159,7 @@ impl PoolBuilder {
                 .get_locked_repository()
                 .unwrap()
                 .borrow_mut()
-                .get_canonical_packages()?
+                .get_packages()?
             {
                 if !self.is_update_allowed(locked_package.clone()) {
                     // remember which packages we skipped loading remote content for in this partial update
@@ -815,7 +815,7 @@ impl PoolBuilder {
                 .get_locked_repository()
                 .unwrap()
                 .borrow_mut()
-                .get_canonical_packages()?
+                .get_packages()?
             {
                 if Preg::is_match3(&pattern_regexp, &package.get_name(), None) {
                     continue 'outer;
-- 
cgit v1.3.1