Installation request for roave/security-advisories (locked at dev-master, required as dev-latest)

[adamtomat]

• I've read the guidelines for Contributing to Roots Projects
• This request isn't a duplicate of an existing issue
• I've read the docs and followed them (if applicable)
• This is not a personal support request that should be posted on the Roots Discourse community

Description

6 days ago, the "roave/security-advisories" package was changed to use dev-latest rather than dev-master (https://github.com/roots/bedrock/pull/609/files). After creating a new Bedrock site and running "composer require some/package", composer fails because Bedrock's composer.lock file still references roave/security-advisories:dev-master:

bedrock/composer.lock

Line 982 in 387e49e

"version": "dev-master",

I believe your composer.lock file needs regenerating and committing.

Steps to reproduce

1. Create a new bedrock project: composer create-project roots/bedrock
2. Install any package, e.g. cd bedrock && composer require guzzlehttp/guzzle

Expected behaviour: [What you expect to happen]
Composer installs the requested package (guzzle in this example)

Actual behavior: [What actually happens]
Composer gives the following error and fails:

Problem 1
- Can only install one of: roave/security-advisories[dev-latest, dev-master].
- Can only install one of: roave/security-advisories[dev-master, dev-latest].
- Can only install one of: roave/security-advisories[dev-latest, dev-master].
- Installation request for roave/security-advisories dev-latest -> satisfiable by roave/security-advisories[dev-latest].
- Installation request for roave/security-advisories (locked at dev-master, required as dev-latest) -> satisfiable by roave/security-advisories[dev-master].

Reproduces how often: [What percentage of the time does it reproduce?]
Happens every time.

Versions

Bedrock: 1.16.1
MacBook Pro (2019) - macOS Big Sur 11.6

[swalkinshaw]

Ah sorry. Want to do the update and submit a PR?

[adamtomat]

Sure thing