Should doctrine/dbal version be updated in composer.json?

[yurtesen]

doctrine/doctrine-bundle requires "doctrine/dbal": "^2.5.12" however this is an older version. Currently doctrine/orm v2.5.12 which is in require-dev, requires "doctrine/dbal": ">=2.5-dev,<2.7-dev" and I believe soon it will be ^2.6 should you match it or was it on purpose to fixate on a very specific version?

I was just wondering because I recently had to upgrade to dbal ~2.6 to get jsonb support. It was not nice that doctrine-bundle kept trying to install 2.5.12 😄

[stof]

^2.5.12 means >=2.5.12 <3.0.0. So there is nothing wrong about it.

[yurtesen]

I disagree. For example now there is doctrine/dbal 2.5.13 which includes bugfixes. Now doctrine/doctrine-bundle requires a package which has known bugs, when it does not have to. How is that OK ?

Again, the question boils down to "why?". Why can't doctrine/doctrine-bundle use the same ">=2.5-dev,<2.7-dev" range? Is there a logical explanation?

It would have been nice if you could at least reason why so specific version is used before you closed the issue.

[alcaeus]

Now doctrine/doctrine-bundle requires a package which has known bugs, when it does not have to.

No, it doesn't. It requires at least version 2.5.12, which may or may not have bugs. composer will always pick the latest version that matches the constraint, unless you specify otherwise. Running composer require doctrine/doctrine-bundle will install doctrine/dbal 2.5.13 unless you specified --prefer-lowest (which you shouldn't without understanding the implications).

Why can't doctrine/doctrine-bundle use the same ">=2.5-dev,<2.7-dev" range? Is there a logical explanation?

Simply because it's a different constraint that doesn't make sense here. ^2.5.12 amounts to >=2.5.12,<3.0.0. Changing the constraint to what you suggested would break the version requirement to 2.5.12 by allowing 2.5.0 to be installed. At the same time, it restricts you to a 2.5 or 2.6 version of DBAL even though there's no logical reason not to allow 2.7.0 since we follow SemVer.

Ninja edit:

It would have been nice if you could at least reason why so specific version is used before you closed the issue.

Looking at the blame view leads to #677. This is something you can find on your own if you're interested.

[yurtesen]

Sorry, my fault. I incorrectly thought ^2.5.12 would select highest 2.5.12.* version. I was further confused because it refused to upgrade to dbal version 2.6 (perhaps because I forgot to give --with-dependencies option 😭 ). You are right, according to caret documentation it should match >=2.5.12 <3.0.0.