Strict mode for --prefer-lowest with dev install, which bumps up the main dependencies

[Sysix]

Hello,

I tested --prefer-lowest according to the offical docs.
Because some of my test tools requires a specific version of a framework, I found the following use case:

My Setup

composer.json

{
  "require": {
    "package/core": "^9.0|^10.0"
}
"require-dev": {
    "package/test-core": "^9.20|^10.0"
}

Problem

The package/test-core can only check the same version of package/core. So still, with --prefer-lowest we install at least version above 9.20 in our (unit) tests.
This example is really simplified. In my use case, there are different versions with different requirements for the test package

Possible Solution

Add a "strict" mode when installed with --prefer-lowest with the dev packages. This would be the best scenario, but it would probably break some already defined CI pipelines.
Another --strict argument would probably solve this too :)

[fredden]

1. Does package/test-core correctly specify the versions of package/core that it supports in its require section?
2. You've mentioned --prefer-lowest, but not the commands that you're running. Are you including --no-dev when running composer update, for example?

[Seldaek]

--no-dev would not help, as we always must resolve all dependencies together. --no-dev only applies to the install step, it does not change the dependency resolution.

So I don't think this can be done at all, I'm not sure what this magical --strict flag would be supposed to do but I doubt we can fix this situation.

[Sysix]

1. yes that why composer will install a higher version then the lowest required one defined.

I just want to be sure that I, as a vendor, specific the right minimum version. Because my "customers" dont install my dev packages, this will maybe cause errors in their packages.

Maybe "strict" is not the word for this use case. I guess it is more of a validation

[Seldaek]

Yeah I understand what you are trying to do, and it makes sense, but it's not doable unless you make sure dev dependencies do not conflict with non-dev ones.

If you want to be safe then make sure to put in require whatever version --prefer-lowest resolves to based on all requirements. That way no surprises for users of the package.