ionbazan/composer-diff

Compares composer.lock changes and generates Markdown report so you can use it in PR description.

Composer Diff Plugin

Generates packages changes report in Markdown format by comparing composer.lock files. Compares with last-committed changes by default.

Now available as GitHub Action!

Installation

composer global require ion-bazan/composer-diff

Usage

composer diff # Displays packages changed in current git tree compared with HEAD
composer diff --help # Display detailed usage instructions

Example output

Prod Packages	Operation	Base	Target
psr/event-dispatcher	New	-	1.0.0
symfony/deprecation-contracts	New	-	v2.1.2
symfony/event-dispatcher	Upgraded	v2.8.52	v5.1.2
symfony/event-dispatcher-contracts	New	-	v2.1.2
symfony/polyfill-php80	New	-	v1.17.1
php	New	-	>=5.3

Dev Packages	Operation	Base	Target
phpunit/php-code-coverage	Downgraded	8.0.2	7.0.10
phpunit/php-file-iterator	Downgraded	3.0.2	2.0.2
phpunit/php-text-template	Downgraded	2.0.1	1.2.1
phpunit/php-timer	Downgraded	5.0.0	2.1.2
phpunit/php-token-stream	Downgraded	4.0.2	3.1.1
phpunit/phpunit	Downgraded	9.2.5	8.5.8
sebastian/code-unit-reverse-lookup	Downgraded	2.0.1	1.0.1
sebastian/comparator	Downgraded	4.0.2	3.0.2
sebastian/diff	Downgraded	4.0.1	3.0.2
sebastian/environment	Downgraded	5.1.1	4.2.3
sebastian/exporter	Downgraded	4.0.1	3.1.2
sebastian/global-state	Downgraded	4.0.0	3.0.0
sebastian/object-enumerator	Downgraded	4.0.1	3.0.3
sebastian/object-reflector	Downgraded	2.0.1	1.1.1
sebastian/recursion-context	Downgraded	4.0.1	3.0.0
sebastian/resource-operations	Downgraded	3.0.1	2.0.1
sebastian/type	Downgraded	2.1.0	1.1.3
sebastian/version	Downgraded	3.0.0	2.0.1
phpunit/php-invoker	Removed	3.0.1	-
sebastian/code-unit	Removed	1.0.3	-

Options

• --base (-b) - path, URL or git ref to original composer.lock file
• --target (-t) - path, URL or git ref to modified composer.lock file
• --no-dev - ignore dev dependencies (require-dev)
• --no-prod - ignore prod dependencies (require)
• --with-platform (-p) - include platform dependencies (PHP, extensions, etc.)
• --with-links (-l) - include compare/release URLs
• --format (-f) - output format (mdtable, mdlist, json, github) - default: mdtable
• --gitlab-domains - custom gitlab domains for compare/release URLs - default: use composer config

Advanced usage

composer diff master # Compare current composer.lock with the one on master branch
composer diff master:composer.lock develop:composer.lock -p # Compare master and develop branches, including platform dependencies
composer diff --no-dev # ignore dev dependencies
composer diff -p # include platform dependencies
composer diff -f json # Output as JSON instead of table

You can find more documentation in the docs directory.

Strict mode

To help you control your dependencies, you may pass --strict option when running in CI. If there are any changes detected, a non-zero exit code will be returned.

Exit code of the command is built using following bit flags:

• 0 - OK.
• 1 - General error.
• 2 - There were changes in prod packages.
• 4 - There were changes is dev packages.
• 8 - There were downgrades in prod packages.
• 16 - There were downgrades in dev packages.

You may check for individual flags or simply check if the status is greater or equal 8 if you don't want to downgrade any package.

Contributing

Composer Diff is an open source project that welcomes pull requests and issues from anyone. Before opening pull requests, please consider reading our short Contribution Guidelines.

Similar packages

While there are several existing packages offering similar functionality:

• jbzoo/composer-diff - requires PHP 7.2+, no composer plugin support
• josefglatz/composer-diff-plugin - works only right after install/update
• davidrjonas/composer-lock-diff - does not work as composer plugin

This package offers:

• Support for wide range of PHP versions, starting from 5.3.2 up to 8.0 and newer.
• No dependencies if you run it as composer plugin.
• Both standalone executable and composer plugin interface - you choose how you want to use it.
• Allows generating reports in several formats.
• Extra Gitlab domains support.
• GitHub Action with example workflow
• 100% test coverage.
• MIT license.

composer-diff's Issues

Inconsistency when comparing dev- versions

Hey, I've integrated your package in my gitlab's CI, and have dangerbot post it as a comment to MR. Thanks for putting it together, it's a great tool, and other similar packages don't support custom gitlab domain.

I've encountered one minor inconsistency when using it for unfinished MRs. The "Operation" column for packages with dev-* is hard to predict. To pinpoint it, I've added to test \IonBazan\ComposerDiff\Tests\Formatter\FormatterTest::testItRendersTheListOfOperations this cases:

new UpdateOperation($this->getPackage('a/package-6', '0.5.2'), $this->getPackage('a/package-6', 'dev-feature', 'dev-feature 1234567')),
new UpdateOperation($this->getPackage('a/package-7', '0.5.2'), $this->getPackage('a/package-7', 'dev-main', 'dev-main 1234567')),
new UpdateOperation($this->getPackage('a/package-8', '0.5.2'), $this->getPackage('a/package-8', 'dev-master', 'dev-master 1234567')),

and the relevant test results were:

Dev Packages	Operation	Base	Target
a/package-6	Downgraded	0.5.2	dev-feature 1234567
a/package-7	Downgraded	0.5.2	dev-main 1234567
a/package-8	Upgraded	0.5.2	dev-master 1234567

I think it would make sense to consider operations with dev- either always show up as Upgraded, or show something neutral, like Changed?

The current behavior is caused by \Composer\Semver\VersionParser::normalizeDefaultBranch called in \Composer\Semver\Semver::sort - it does:

if ($name === 'dev-master' || $name === 'dev-default' || $name === 'dev-trunk') {
     return '9999999-dev';
}

Also, I think the composer implementation of version comparison always assumes that changes involving dev- are an upgrade, no matter the change. Maybe in \IonBazan\ComposerDiff\Formatter\AbstractFormatter::isUpgrade you could simply use composer's \Composer\Package\Version\VersionParser::isUpgrade?

Upgrading one dev version to another may produce duplicate entry

After upgrading rector/rector from 0420629 to 2e028e5 (dev-main), composer diff produced following output:

             "source": {
                 "type": "git",
                 "url": "https://github.com/rectorphp/rector.git",
-                "reference": "04206292794cdf1932d3c8d7ce1ed139d69039fd"
+                "reference": "2e028e5734f34f4afeb34e8b8c2da021b731760a"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/rectorphp/rector/zipball/04206292794cdf1932d3c8d7ce1ed139d69039fd",
-                "reference": "04206292794cdf1932d3c8d7ce1ed139d69039fd",
+                "url": "https://api.github.com/repos/rectorphp/rector/zipball/2e028e5734f34f4afeb34e8b8c2da021b731760a",
+                "reference": "2e028e5734f34f4afeb34e8b8c2da021b731760a",
                 "shasum": ""
             },

While version constraint didn't change, it should produce only a single "change" row instead of "update" and "change".

This might be caused by the branch alias though.

List transitive platform dependencies changes

Currently platform requirement changes are only listed when they are explicitly defined in the root package composer.json. Requiring a package with a transitive platform requirement causes such dependency to be ignored.

That's because such package only appears in packages.<package-name>.require section and not in platform section.

Test plugin initialization

It is important to test whether the plugin is actually properly installed and commands are registered.
This is partially done in b44fcd2 but requires Composer v2. A backport for Composer v1 is needed to prevent future regressions.

Use of mutation testing in composer-diff - Help needed

Hello there!

My name is Ana. I noted that you use the mutation testing tool infection in the project.
I am a postdoctoral researcher at the University of Seville (Spain), and my colleagues and I are studying how mutation testing tools are used in practice. With this aim in mind, we have analysed over 3,500 public GitHub repositories using mutation testing tools, including yours! This work has recently been published in a journal paper available at https://link.springer.com/content/pdf/10.1007/s10664-022-10177-8.pdf.

To complete this study, we are asking for your help to understand better how mutation testing is used in practice, please! We would be extremely grateful if you could contribute to this study by answering a brief survey of 21 simple questions (no more than 6 minutes). This is the link to the questionnaire https://forms.gle/FvXNrimWAsJYC1zB9.

Drop me an e-mail if you have any questions or comments ([email protected]). Thank you very much in advance!!

Support Drupal packages with links and diffs

It would be nice to support Drupal.org's packages with composer diff links and diffs, currently they are not supported.

PHP CS Fixer doesn't run automatically

Just noticed after my MR that PHP CS Fixer has rules included, but it's not a dev dependency, nor run via GitHub Actions.

Console Hyperlink support

Add new formatter - text which would render links as clickable hyperlinks directly in the terminal like Composer v2.3 does:

This could be a default behaviour in v2 so that users can navigate to the packages' source page and diff links.

Things to consider:

• Should links be always clickable or only when -l flag is passed? Some terminals don't support hyperlinks so -l could make them render as strings like in v1.
• Should this formatter be default from now? Would CI environments be affected? Those using GitHub Action could set mdtable by default for compatibility.
• Perhaps we could just merge that with mdtable so that the link is always rendered and -l would enforce a markdown-compatible link instead?

Could not open file branch-name:composer.lock or find it in git as branch-name:composer.lock: fatal: invalid object name 'branch-name'

See job output: https://github.com/qossmic/deptrac/actions/runs/8007789467/job/21872726582?pr=1374

In PackageDiff.php line 136:
                                                                               
  [RuntimeException]                                                           
  Could not open file composer-dependency-analyser:composer.lock or find it i  
  n git as composer-dependency-analyser:composer.lock: fatal: invalid object   
  name 'composer-dependency-analyser'.                                         
                                                                               

Exception trace:
  at /workdir/vendor/ion-bazan/composer-diff/src/PackageDiff.php:136
 IonBazan\ComposerDiff\PackageDiff->getFileContents() at /workdir/vendor/ion-bazan/composer-diff/src/PackageDiff.php:92
 IonBazan\ComposerDiff\PackageDiff->loadPackages() at /workdir/vendor/ion-bazan/composer-diff/src/PackageDiff.php:79
 IonBazan\ComposerDiff\PackageDiff->getPackageDiff() at /workdir/vendor/ion-bazan/composer-diff/src/Command/DiffCommand.php:141
 IonBazan\ComposerDiff\Command\DiffCommand->execute() at /workdir/vendor/symfony/console/Command/Command.php:312
 Symfony\Component\Console\Command\Command->run() at /workdir/vendor/symfony/console/Application.php:1022
 Symfony\Component\Console\Application->doRunCommand() at /workdir/vendor/symfony/console/Application.php:314
 Symfony\Component\Console\Application->doRun() at /workdir/vendor/symfony/console/Application.php:168
 Symfony\Component\Console\Application->run() at /workdir/vendor/ion-bazan/composer-diff/composer-diff:[30](https://github.com/qossmic/deptrac/actions/runs/8007723786/job/21872510353?pr=1374#step:4:31)
 include() at /workdir/vendor/bin/composer-diff:120

Maybe related to the fact that the newly added package in the PR has composer.lock committed and not export-ignored in .gitattributes, but I'm guessing here.

Link to project?

If links are enabled, could there be a link to the project too?