Merge branch 'main' into audit-command-checks-alias

composer.json

@@ -33,7 +33,7 @@
         "psr/log": "^1.0 || ^2.0 || ^3.0",
         "seld/jsonlint": "^1.4",
         "seld/phar-utils": "^1.2",
-        "symfony/console": "^5.4.11 || ^6.0.11",
+        "symfony/console": "^5.4.11 || ^6.0.11 || ^7",
         "symfony/filesystem": "^5.4 || ^6.0 || ^7",
         "symfony/finder": "^5.4 || ^6.0 || ^7",
         "symfony/process": "^5.4 || ^6.0 || ^7",

doc/03-cli.md

@@ -198,8 +198,9 @@ php composer.phar update vendor/package:2.0.1 vendor/package2:3.0.*
 * **--no-install:** Does not run the install step after updating the composer.lock file.
 * **--no-audit:** Does not run the audit steps after updating the composer.lock file. Also see [COMPOSER_NO_AUDIT](#composer-no-audit).
 * **--audit-format:** Audit output format. Must be "table", "plain", "json", or "summary" (default).
-* **--lock:** Only updates the lock file hash to suppress warning about the
-  lock file being out of date.
+* **--lock:** Overwrites the lock file hash to suppress warning about the lock file being out of
+  date without updating package versions. Package metadata like mirrors and URLs are updated if
+  they changed.
 * **--with:** Temporary version constraint to add, e.g. foo/bar:1.0.0 or foo/bar=1.0.0
 * **--no-autoloader:** Skips autoloader generation.
 * **--no-progress:** Removes the progress display that can mess with some

src/Composer/DependencyResolver/LockTransaction.php

@@ -15,6 +15,7 @@
 use Composer\Package\AliasPackage;
 use Composer\Package\BasePackage;
 use Composer\Package\Package;
+use Composer\Pcre\Preg;
 
 /**
  * @author Nils Adermann <naderman@naderman.de>
@@ -111,6 +112,14 @@ public function getNewLockPackages(bool $devMode, bool $updateMirrors = false):
                         if ($package->getName() === $presentPackage->getName() && $package->getVersion() === $presentPackage->getVersion()) {
                             if ($presentPackage->getSourceReference() && $presentPackage->getSourceType() === $package->getSourceType()) {
                                 $package->setSourceDistReferences($presentPackage->getSourceReference());
+                                // if the dist url is not one of those handled gracefully by setSourceDistReferences then we should overwrite it with the old one
+                                if ($package->getDistUrl() !== null && !Preg::isMatch('{^https?://(?:(?:www\.)?bitbucket\.org|(api\.)?github\.com|(?:www\.)?gitlab\.com)/}i', $package->getDistUrl())) {
+                                    $package->setDistUrl($presentPackage->getDistUrl());
+                                }
+                                $package->setDistType($presentPackage->getDistType());
+                                if ($package instanceof Package) {
+                                    $package->setDistSha1Checksum($presentPackage->getDistSha1Checksum());
+                                }
                             }
                             if ($presentPackage->getReleaseDate() !== null && $package instanceof Package) {
                                 $package->setReleaseDate($presentPackage->getReleaseDate());

src/Composer/Package/Version/VersionBumper.php

@@ -40,6 +40,7 @@ class VersionBumper
      *  * ^3@dev + 3.2.99999-dev  -> ^3.2@dev
      *  * ~2 + 2.0-beta.1         -> ~2
      *  * dev-master + dev-master -> dev-master
+     *  * * + 1.2.3               -> >=1.2.3
      */
     public function bumpRequirement(ConstraintInterface $constraint, PackageInterface $package): string
     {
@@ -86,6 +87,7 @@ public function bumpRequirement(ConstraintInterface $constraint, PackageInterfac
                 | ~v?'.$major.'(?:\.\d+){0,2} # e.g. ~2 or ~2.2 or ~2.2.2 but no more
                 | v?'.$major.'(?:\.[*x])+ # e.g. 2.* or 2.*.* or 2.x.x.x etc
                 | >=v?\d(?:\.\d+)* # e.g. >=2 or >=1.2 etc
+                | \* # full wildcard
             )
             (?=,|$|\ |\||@) # trailing separator
         }x';
@@ -99,7 +101,7 @@ public function bumpRequirement(ConstraintInterface $constraint, PackageInterfac
                 }
                 if (str_starts_with($match[0], '~') && substr_count($match[0], '.') === 2) {
                     $replacement = '~'.$versionWithoutSuffix.$suffix;
-                } elseif (str_starts_with($match[0], '>=')) {
+                } elseif ($match[0] === '*' || str_starts_with($match[0], '>=')) {
                     $replacement = '>='.$versionWithoutSuffix.$suffix;
                 } else {
                     $replacement = $newPrettyConstraint.$suffix;