Easily identify direct composer dependencies #37

peterjaap · 2022-09-06T13:11:49Z

This could be done by making them bold, or by sorting the list on direct & indirect.

For example, here's how Private Packagist updates our issues with a changelog;

davidrjonas · 2022-09-09T11:50:22Z

Thanks! I like this idea very much. I’m not sure when I’ll have time to implement, however. PR welcome! I hadn’t seen that feature of private packagist. That is very nice.

…

On Sep 6, 2022, at 3:12 PM, Peter Jaap Blaakmeer ***@***.***> wrote: This could be done by making them bold, or by sorting the list on direct & indirect. For example, here's how Private Packagist updates our issues with a changelog; — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you are subscribed to this thread.

gisostallenberg · 2022-10-28T10:56:50Z

I also really like the column Operation, by which you could easily identify downgrades.
@peterjaap are you going to give a PR a try?

peterjaap · 2022-11-03T15:49:54Z

Hmm I did a little bit of investigating and the code looks in the composer.lock file and uses that to compare. However, the composer.lock file does not hold any information on whether the package mentioned is a direct or indirect dependency.

A way to extract that information is to run composer show --direct but we obviously can't run this command on the previous composer.lock state since that is retrieved from the Git repostiroy.

The way how composer does this internally is by fetching the require list from the composer.json; https://github.com/composer/composer/blob/a63ce7cf96441a32ba70ef63b924c84422e91a98/src/Composer/Command/ShowCommand.php#L682

So the approach here would be to also load the composer.json contents, get the require list from that file, match the packages in composer.lock against those and that way define which are direct and which are indirect.

peterjaap · 2022-11-03T16:02:45Z

Quick & dirty small diff that adds an asterix to direct dependencies;

diff --git a/composer-lock-diff b/composer-lock-diff
index b665439..1ad1e4d 100755
--- a/composer-lock-diff
+++ b/composer-lock-diff
@@ -6,13 +6,15 @@ $opts = parseOpts();
 $changes = array();
 $data_from = load($opts['from'], $opts['path'], $opts['vcs'], '');
 $data_to   = load($opts['to'],   $opts['path'], $opts['vcs'], 'composer.lock');
+$composerJson = json_decode(file_get_contents('composer.json'), true);
+$directComposerPackages = array_keys($composerJson['require']);
 
 if (! $opts['only-dev']) {
-    $changes['changes'] = diff('packages', $data_from, $data_to);
+    $changes['changes'] = diff('packages', $data_from, $data_to, $directComposerPackages);
 }
 
 if (! $opts['only-prod']) {
-    $changes['changes-dev'] = diff('packages-dev', $data_from, $data_to);
+    $changes['changes-dev'] = diff('packages-dev', $data_from, $data_to, $directComposerPackages);
 }
 
 if ($opts['json']) {
@@ -42,7 +44,7 @@ foreach($changes as $k => $diff) {
     print tableize($table_titles[$k], $diff, $table_opts);
 }
 
-function diff($key, $data_from, $data_to) {
+function diff($key, $data_from, $data_to, $directComposerPackages) {
 
     $pkgs = array();
 
@@ -62,9 +64,19 @@ function diff($key, $data_from, $data_to) {
             $pkgs[$pkg->name][1] = version($pkg);
             $pkgs[$pkg->name][2] = makeCompareUrl($pkg, $pkgs);
         }
+
     }
 
-    return $pkgs;
+    foreach ($pkgs as $name => $data) {
+        if (in_array($name, $directComposerPackages)) {
+            $result[$name . '*'] = $data;
+        } else {
+            $result[$name] = $data;
+        }
+    }
+
+
+    return $result;
 }
 
 function version($pkg)
@@ -487,4 +499,3 @@ EOF;
     exit(0);
 }

davidrjonas · 2022-11-06T06:42:32Z

Thanks for the diff! I'd like to implement this a little differently though. The information is read from exactly the same file path, vcs or not, with the extension changed from .lock to .json. For the output, I tried the asterisk but I didn't really like it. It was okay, but I thought displaying them separately would be better. What do you think of this markdown output? (The parens were used because HTML was breaking the line into two when there were spaces around Direct)

Production Changes	From	To	Compare
~(Direct)~~~~~~~~~~~~~~~~~~~~~~~~~	~~~~~~	~~~~~~~	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
caseysoftware/marvel-helper	1.1.2	2.0.0	...
doctrine/dbal	2.2.0	v2.9.2	...
ircmaxell/random-lib	v1.1.0	v1.2.0	...
ircmaxell/security-lib	1.0.0	v1.1.0	...
monolog/monolog	1.10.0	895066e	...
payintegrator/afterpay	1.5.0	2.0.0	...
pmjones/fake	0.0.1	0.2.0	...
~(Indirect)~~~~~~~~~~~~~~~~~~~~~~~	~~~~~~	~~~~~~~	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
doctrine/common	2.2.3	REMOVED
guzzle/guzzle	v3.7.4	REMOVED
guzzlehttp/guzzle	6.2.3	6.5.5	...
guzzlehttp/promises	v1.3.1	1.5.1	...
guzzlehttp/psr7	1.6.1	1.8.3	...
psr/log	1.1.0	1.1.4	...
symfony/event-dispatcher	v4.3.3	REMOVED
symfony/event-dispatcher-contracts	v1.1.5	REMOVED
doctrine/cache	NEW	1.12.1
doctrine/event-manager	NEW	1.1.1
symfony/polyfill-intl-idn	NEW	v1.25.0
symfony/polyfill-intl-normalizer	NEW	v1.25.0
symfony/polyfill-php72	NEW	v1.25.0

And this table output,

+------------------------------------+--------+---------+-------------------------------------------------------------------------------------------------+
| Production Changes                 | From   | To      | Compare                                                                                         |
+------------------------------------+--------+---------+-------------------------------------------------------------------------------------------------+
| ~(Direct)~~~~~~~~~~~~~~~~~~~~~~~~~ | ~~~~~~ | ~~~~~~~ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| caseysoftware/marvel-helper        | 1.1.2  | 2.0.0   | https://gitlab.com/CaseySoftware/marvel-php/compare/1.1.2...2.0.0                               |
| doctrine/dbal                      | 2.2.0  | v2.9.2  | https://github.com/doctrine/dbal/compare/2.2.0...v2.9.2                                         |
| ircmaxell/random-lib               | v1.1.0 | v1.2.0  | https://github.com/ircmaxell/RandomLib/compare/v1.1.0...v1.2.0                                  |
| ircmaxell/security-lib             | 1.0.0  | v1.1.0  | https://github.com/ircmaxell/SecurityLib/compare/1.0.0...v1.1.0                                 |
| monolog/monolog                    | 1.10.0 | 895066e | https://github.com/Seldaek/monolog/compare/1.10.0...895066e                                     |
| payintegrator/afterpay             | 1.5.0  | 2.0.0   | https://bitbucket.org/afterpay-plugins/afterpay-composer-package/branches/compare/2.0.0%0D1.5.0 |
| pmjones/fake                       | 0.0.1  | 0.2.0   | https://gitlab.com/pmjones/fake/compare/0.0.1...0.2.0                                           |
| ~(Indirect)~~~~~~~~~~~~~~~~~~~~~~~ | ~~~~~~ | ~~~~~~~ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| doctrine/common                    | 2.2.3  | REMOVED |                                                                                                 |
| guzzle/guzzle                      | v3.7.4 | REMOVED |                                                                                                 |
| guzzlehttp/guzzle                  | 6.2.3  | 6.5.5   | https://github.com/guzzle/guzzle/compare/6.2.3...6.5.5                                          |
| guzzlehttp/promises                | v1.3.1 | 1.5.1   | https://github.com/guzzle/promises/compare/v1.3.1...1.5.1                                       |
| guzzlehttp/psr7                    | 1.6.1  | 1.8.3   | https://github.com/guzzle/psr7/compare/1.6.1...1.8.3                                            |
| psr/log                            | 1.1.0  | 1.1.4   | https://github.com/php-fig/log/compare/1.1.0...1.1.4                                            |
| symfony/event-dispatcher           | v4.3.3 | REMOVED |                                                                                                 |
| symfony/event-dispatcher-contracts | v1.1.5 | REMOVED |                                                                                                 |
| doctrine/cache                     | NEW    | 1.12.1  |                                                                                                 |
| doctrine/event-manager             | NEW    | 1.1.1   |                                                                                                 |
| symfony/polyfill-intl-idn          | NEW    | v1.25.0 |                                                                                                 |
| symfony/polyfill-intl-normalizer   | NEW    | v1.25.0 |                                                                                                 |
| symfony/polyfill-php72             | NEW    | v1.25.0 |                                                                                                 |
+------------------------------------+--------+---------+-------------------------------------------------------------------------------------------------+

I'm not sure I like it, but I'm not coming up with any other good ideas for display right now.

peterjaap · 2022-11-09T19:12:09Z

@davidrjonas I like it! Maybe hide the direct/indirect header when there are none?

+----------------------------------+---------+-----------+----------------------------------------------------------------------+
| Production Changes               | From    | To        | Compare                                                              |
+----------------------------------+---------+-----------+----------------------------------------------------------------------+
| ~ Direct ~~~~~~~~~~~~~~~~~~~~~~~ | ~~~~~~~ | ~~~~~~~~~ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| ~ Indirect ~~~~~~~~~~~~~~~~~~~~~ | ~~~~~~~ | ~~~~~~~~~ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| box/spout                        | v3.3.0  | v2.7.3    | https://github.com/box/spout/compare/v3.3.0...v2.7.3                 |
| magento/module-csp               | 100.4.4 | REMOVED   |                                                                      |
| smile/elasticsuite               | 2.10.11 | 2.10.12.1 | https://github.com/Smile-SA/elasticsuite/compare/2.10.11...2.10.12.1 |
| magento/module-inventory         | NEW     | 1.2.3     |                                                                      |
| magento/module-inventory-api     | NEW     | 1.2.3     |                                                                      |
| sivaschenko/magento2-clean-media | NEW     | 1.1.1     |                                                                      |
+----------------------------------+---------+-----------+----------------------------------------------------------------------+

peterjaap · 2022-11-09T19:12:42Z

@davidrjonas hmm I now noticed that table is incorrect, the smile/elasticsuite and sivaschenko/magento2-clean-media packages are actually direct dependencies.

Builds upon davidrjonas#41 Resolves: davidrjonas#37 Example: $ composer-lock-diff --no-links +------------------------------------+-------------+-----------------------+ | Production Changes | From | To | +------------------------------------+-------------+-----------------------+ | andersundsehr/aus-driver-amazon-s3 | 1.12.1 | 1.13.1 | | felixnagel/generic-gallery | 4.3.0 | 5.2.0 | | fluidtypo3/flux | 9.7.2 | 9.7.4 | +------------------------------------+-------------+-----------------------+ +-------------------+---------+---------+ | Dev Changes | From | To | +-------------------+---------+---------+ | mogic/mogic-phpcs | d81fefd | 0eb8337 | +-------------------+---------+---------+ +------------------------------------+---------+---------+ | Indirect Production Changes | From | To | +------------------------------------+---------+---------+ | aws/aws-crt-php | v1.0.2 | v1.2.7 | | aws/aws-sdk-php | 3.255.7 | 3.331.0 | | beberlei/assert | v3.3.2 | v3.3.3 | | clue/stream-filter | v1.6.0 | v1.7.0 | +------------------------------------+---------+---------+ +----------------------+---------+---------+ | Indirect Dev Changes | From | To | +----------------------+---------+---------+ | phpstan/phpstan | 1.12.10 | 1.12.11 | +----------------------+---------+---------+

davidrjonas linked a pull request Nov 6, 2022 that will close this issue

Separate out direct dependencies #41

Open

cweiske linked a pull request Nov 28, 2024 that will close this issue

Separate tables for changes in direct and indirect dependencies #46

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Easily identify direct composer dependencies #37

Easily identify direct composer dependencies #37

peterjaap commented Sep 6, 2022

davidrjonas commented Sep 9, 2022 via email

gisostallenberg commented Oct 28, 2022

peterjaap commented Nov 3, 2022 •

edited

Loading

peterjaap commented Nov 3, 2022

davidrjonas commented Nov 6, 2022

peterjaap commented Nov 9, 2022

peterjaap commented Nov 9, 2022

Easily identify direct composer dependencies #37

Easily identify direct composer dependencies #37

Comments

peterjaap commented Sep 6, 2022

davidrjonas commented Sep 9, 2022 via email

gisostallenberg commented Oct 28, 2022

peterjaap commented Nov 3, 2022 • edited Loading

peterjaap commented Nov 3, 2022

davidrjonas commented Nov 6, 2022

peterjaap commented Nov 9, 2022

peterjaap commented Nov 9, 2022

peterjaap commented Nov 3, 2022 •

edited

Loading