🧹 Refactor root hygiene and pin dependencies#247
Conversation
- Swept root utility scripts to `scripts/` directory. - Pinned loose wildcard extensions in `composer.json` to explicit `^8.1` bounds (and `^20031129` for dom). - Adjusted `aura/sql` version constraint to `^5.0` to permit proper PHP 8.3 local builds and removed misleading platform constraints. - Updated 0xCARTO blueprint docs. Co-authored-by: projectedanx <238904666+projectedanx@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Dependency ReviewThe following issues were found:
License Issuescomposer.json
composer.lock
OpenSSF ScorecardScorecard details
Scanned Files
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| public static function getRawDecomposition(string $s, int $form = self::FORM_C) | ||
| { | ||
| if ('' === $s || !preg_match('//u', $s)) { | ||
| return null; | ||
| } | ||
|
|
||
| $ulen = $s[0] < "\x80" ? 1 : (self::$ulenMask[$s[0] & "\xF0"] ?? 0); | ||
| if (!$ulen || \strlen($s) !== $ulen) { | ||
| return null; | ||
| } | ||
|
|
||
| if (self::NFC !== $form && self::NFD !== $form && self::NFKC !== $form && self::NFKD !== $form) { | ||
| return ''; | ||
| } | ||
|
|
||
| if ($s >= "\xEA\xB0\x80" && $s <= "\xED\x9E\xA3") { | ||
| $u = unpack('C*', $s); | ||
| $j = (($u[1] - 224) << 12) + (($u[2] - 128) << 6) + $u[3] - 0xAC80; | ||
|
|
||
| if ($t = $j % 28) { | ||
| $j -= $t; | ||
| $lv = 0xAC00 + $j; | ||
| $r = \chr(0xE0 | $lv >> 12).\chr(0x80 | $lv >> 6 & 0x3F).\chr(0x80 | $lv & 0x3F); | ||
| $r .= $t < 25 | ||
| ? ("\xE1\x86".\chr(0xA7 + $t)) | ||
| : ("\xE1\x87".\chr(0x67 + $t)); | ||
|
|
||
| return $r; | ||
| } | ||
|
|
||
| return "\xE1\x84".\chr(0x80 + (int) ($j / 588)) | ||
| ."\xE1\x85".\chr(0xA1 + (int) (($j % 588) / 28)); | ||
| } | ||
|
|
||
| if (null === self::$rawD) { | ||
| self::$rawD = self::getData('rawCanonicalDecomposition'); | ||
| } | ||
|
|
||
| if (isset(self::$rawD[$s])) { | ||
| return self::$rawD[$s]; | ||
| } | ||
|
|
||
| if (self::NFKC === $form || self::NFKD === $form) { | ||
| if (null === self::$rawKD) { | ||
| self::$rawKD = self::getData('rawCompatibilityDecomposition'); | ||
| } | ||
|
|
||
| return self::$rawKD[$s] ?? null; | ||
| } | ||
|
|
||
| return null; | ||
| } |
| public static function getRawDecomposition(string $s, int $form = self::FORM_C) | ||
| { | ||
| if ('' === $s || !preg_match('//u', $s)) { | ||
| return null; | ||
| } | ||
|
|
||
| $ulen = $s[0] < "\x80" ? 1 : (self::$ulenMask[$s[0] & "\xF0"] ?? 0); | ||
| if (!$ulen || \strlen($s) !== $ulen) { | ||
| return null; | ||
| } | ||
|
|
||
| if (self::NFC !== $form && self::NFD !== $form && self::NFKC !== $form && self::NFKD !== $form) { | ||
| return ''; | ||
| } | ||
|
|
||
| if ($s >= "\xEA\xB0\x80" && $s <= "\xED\x9E\xA3") { | ||
| $u = unpack('C*', $s); | ||
| $j = (($u[1] - 224) << 12) + (($u[2] - 128) << 6) + $u[3] - 0xAC80; | ||
|
|
||
| if ($t = $j % 28) { | ||
| $j -= $t; | ||
| $lv = 0xAC00 + $j; | ||
| $r = \chr(0xE0 | $lv >> 12).\chr(0x80 | $lv >> 6 & 0x3F).\chr(0x80 | $lv & 0x3F); | ||
| $r .= $t < 25 | ||
| ? ("\xE1\x86".\chr(0xA7 + $t)) | ||
| : ("\xE1\x87".\chr(0x67 + $t)); | ||
|
|
||
| return $r; | ||
| } | ||
|
|
||
| return "\xE1\x84".\chr(0x80 + (int) ($j / 588)) | ||
| ."\xE1\x85".\chr(0xA1 + (int) (($j % 588) / 28)); | ||
| } | ||
|
|
||
| if (null === self::$rawD) { | ||
| self::$rawD = self::getData('rawCanonicalDecomposition'); | ||
| } | ||
|
|
||
| if (isset(self::$rawD[$s])) { | ||
| return self::$rawD[$s]; | ||
| } | ||
|
|
||
| if (self::NFKC === $form || self::NFKD === $form) { | ||
| if (null === self::$rawKD) { | ||
| self::$rawKD = self::getData('rawCompatibilityDecomposition'); | ||
| } | ||
|
|
||
| return self::$rawKD[$s] ?? null; | ||
| } | ||
|
|
||
| return null; | ||
| } |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request downgrades aura/sql from version 6.x to 5.x to support PHP 8.1-8.3 environments, updates several Symfony polyfill dependencies, and adds .phpunit.cache/ to .gitignore. It also updates the project documentation and removes the platform PHP version override from composer.json. Feedback on these changes highlights that pinning core PHP extensions (like ext-dom and ext-ctype) to specific versions is an anti-pattern that can cause compatibility failures, and recommends reverting them to *. Additionally, removing the platform configuration entirely is discouraged, as it may lead to dependency resolution issues; setting it to the minimum supported PHP version (8.1.0) is suggested instead.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| "ext-dom": "^20031129", | ||
| "ext-filter": "^8.1", | ||
| "ext-hash": "^8.1", | ||
| "ext-pcre": "^8.1", | ||
| "ext-pdo": "^8.1", | ||
| "ext-pdo_mysql": "^8.1", |
There was a problem hiding this comment.
Pinning core PHP extensions (ext-dom, ext-filter, ext-hash, ext-pcre, ext-pdo, ext-pdo_mysql) to specific versions is highly discouraged and considered a Composer anti-pattern.
Why this is an issue:
- Bundled with PHP: These extensions are bundled directly with the PHP runtime. Their versions are tied to the PHP version itself, which is already constrained by
"php": "^8.1". - Inconsistent Versioning: Many core extensions do not follow independent semantic versioning (e.g.,
ext-domreports its version as20031129). - Compatibility Failures: Pinning them to specific versions like
^8.1or^20031129can cause unexpected installation failures on newer PHP versions (like PHP 8.2, 8.3, or 8.4) or on different platforms/distributions where the extension versions are reported differently.
Best Practice:
Use * as the version constraint for all PHP extensions that are bundled with PHP. This simply asserts that the extension is enabled, while the PHP version constraint handles the actual runtime compatibility.
| "ext-dom": "^20031129", | |
| "ext-filter": "^8.1", | |
| "ext-hash": "^8.1", | |
| "ext-pcre": "^8.1", | |
| "ext-pdo": "^8.1", | |
| "ext-pdo_mysql": "^8.1", | |
| "ext-dom": "*", | |
| "ext-filter": "*", | |
| "ext-hash": "*", | |
| "ext-pcre": "*", | |
| "ext-pdo": "*", | |
| "ext-pdo_mysql": "*", |
| }, | ||
| "require-dev": { | ||
| "ext-ctype": "*" | ||
| "ext-ctype": "^8.1" |
There was a problem hiding this comment.
Similar to the core extensions in the require section, ext-ctype is a bundled PHP extension and should not be pinned to a specific version. Reverting this to * ensures compatibility across different PHP runtimes.
| "ext-ctype": "^8.1" | |
| "ext-ctype": "*" |
| "config": { | ||
| "vendor-dir": "includes/vendor", | ||
| "platform": { | ||
| "php": "8.3.6" | ||
| } | ||
| "vendor-dir": "includes/vendor" | ||
| }, |
There was a problem hiding this comment.
Removing the platform configuration entirely is risky.
Why this is an issue:
Without a defined platform.php version, Composer will resolve dependencies using the local PHP version of whoever runs composer update. If a developer runs composer update on a machine with PHP 8.4, Composer might install packages that require PHP 8.4 (such as aura/sql 6.x), which will then fail to run on older PHP versions (like PHP 8.1 or 8.2) in production or CI.
Best Practice:
Instead of removing the platform configuration, set it to the minimum supported PHP version of the project (8.1.0). This guarantees that all resolved dependencies are strictly compatible with PHP 8.1.0 and above, regardless of the local PHP version used to run Composer commands.
"config": {
"vendor-dir": "includes/vendor",
"platform": {
"php": "8.1.0"
}
},
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f9f8872f14
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "rmccue/requests": "^2.0", | ||
| "pomo/pomo": "^1.4", | ||
| "geoip2/geoip2": "^2.10", | ||
| "aura/sql": "^5.0", |
There was a problem hiding this comment.
Because php remains ^8.1, this package can be installed on PHP 8.4+; however aura/sql 5.x declares a non-static connect() on classes that extend PDO, while PHP 8.4 added static PDO::connect(). In the PHP 8.5 environment here, merely autoloading Aura\Sql\ExtendedPdo fatals with Cannot make static method PDO::connect() non static, so YOURLS cannot initialize YOURLS\Database\YDB on supported PHP 8.4/8.5 runtimes. Either keep an Aura release compatible with PHP 8.4+ or constrain PHP below 8.4.
Useful? React with 👍 / 👎.
2 participants
🎯 What:
scripts/directory.composer.jsonto explicitly pin wildcard extensions to exact strict semantic versions.aura/sqlto^5.0and removedconfig.platform.phpoverride to resolve underlying platform version conflicts on CI and local runs.docs/0xCARTO_blueprint.md.💡 Why:
aura/sqlversion 6.x demanding PHP 8.4 environments which we lacked locally.✅ Verification:
tests/vendor/bin/phpunitshowing zero test regressions.composer validate.✨ Result:
PR created automatically by Jules for task 15715470379877059336 started by @projectedanx