Match Composer patch versions like Composer does

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

The CLI now matches Composer patches by release version the way Composer does. Composer patches stay installed, and VEX reports them fixed, on every Composer version from 1.10 to 2.10 on Linux, macOS and Windows.

The depscan counterpart is SocketDev/depscan#26854.

Version matching

A Composer patch's base purl can carry the padded version Socket's SBOM ingestion stores (pkg:composer/psr/log@3.0.2.0), while composer.lock and installed.json say 3.0.2 or v3.0.2. The CLI compared the two as strings after stripping v, so it failed in four ways:

• apply and vendor reported the patch "not found";
• the hosted redirect refused it as a version mismatch;
• VEX rejected it;
• scan --prune deleted it.

What changed:

• Version module: utils::composer_version ports composer/semver 3.4.4 VersionParser::normalize.
• Every comparison uses it: crawler, purl_eq, vendor lock lookup, hosted rewriter, redirect ledger, VEX discovery and sources, scan discovery, prune and gc, and the vendored ownership checks in apply, rollback and scan.
• Stored spellings don't change.
• Shared vectors: tests/fixtures/composer-version-vectors.json was generated from real Composer 2.10.3 and is byte-identical to depscan's copy.

Making sure patches are actually installed

• Hosted redirect:
  • removes source wherever it sits in the entry, not only right before dist, because Composer 1.x–2.9 silently fall back to the pristine git source;
  • strips dist.mirrors, including a list placed before url;
  • refuses a dist whose only URL is a mirror.
• Vendored copies: neutralize root .gitignore and export-ignore rules, which make Composer's path mirror drop files. Vendoring refuses when a patched file would be dropped.
• Vendored lockfile edits: only the patched entry in composer.lock is edited. CRLF, mixed line endings, \/ escapes and indentation survive, and vendor --revert is byte-identical.
• VEX: no longer reports a package as fixed when Composer will install it from source. That happens when preferred-install resolves to source, or when it's auto with a dev version on a 1.x/2.0 lock.
• Next-step hints: composer install, with Composer 1 and dist-only reinstall guidance naming the vendor/ dir to remove.

CI

• Exact-release matrix: composer-compatibility.yml covers Composer 1.10.28, 2.0.14, 2.1.14, 2.2.30, 2.5.8, 2.8.12, 2.9.8 and 2.10.3.
  • Linux: every version.
  • macOS and Windows: 1.10.28, 2.2.30 and 2.10.3.
  • Windows also: 2.9.8.
• Triggers: the workflow runs on every composer-related path change.
• Pinned Docker image: Dockerfile.composer installs an exact, checksum-verified Composer.
• Docker tests: Composer Docker tests fail instead of skipping when they're required.
• Docs: the ci.yml comment on the git-source fallback is corrected.

Rebased onto main after #257

Rebased onto 8c381ecf (#257's concurrent, parallel-crawl, single-pass rewriters). Every #270 behavior sits on #257's paths:

• Version identity everywhere, oracles too: composer_versions_equivalent is used at every call site, including Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters #257's composer crawler oracle (crawlers/composer_crawler/oracle.rs) and the hosted rewriter oracle (patch/redirect/composer_equivalence_tests.rs). Both had encoded the old v-strip compare, so they now use Match Composer patch versions like Composer does #270's semantics.
• Hosted source and mirrors: the rewriter keeps Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters #257's walk and in-place splice: test the name first, walk bytes, replace_range per edit. composer_source::apply_dist_edit does the splice, and its recorded edit spans the dist plus the removed source wherever it sits, so the fragment revert stays byte-exact. Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters #257's source-before-dist block (composer_source_before_dist, redirect_composer_source_kept for a non-adjacent source) is gone.
  • The rewriter oracle calls the same helper, keeping its char walk and fresh copy per edit, and has Match Composer patch versions like Composer does #270's already-redirected heal and strip-before-check for mirrors listed before the url.
  • Its random locks now also cover mirrors before the url, a mirror-only dist (redirect_composer_no_dist_url), source before name, and padded or v-prefixed patch versions.
  • Each lock is also checked to revert byte for byte when its edits are undone newest first.
• Vendored lock splice on Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters #257's write path: lock_text::replace_entry output goes through atomic_write_bytes_preserving_mode, which is both the per-run group commit and the durable writer. The parse memo is re-seeded only when the written bytes equal the doc's canonical render; otherwise it is invalidated. A unit test covers this.
  • ComposerPrelude now carries the lock text it parsed.
  • Match Composer patch versions like Composer does #270 adds no refusal before the service call; the mirror-filter conflict comes after the copy. So Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters #257's composer preflight gate and prestaging need no change.
• Mirror filters: neutralizing runs on Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters #257's in-sync hot path, the wired-but-stale rebuild and the fresh vendor. The refusal when a patched file would be dropped is kept.
• VEX source-install veto: reads composer.json through ctx.read_text.
• Vendored ownership by identity: purl_keys_cover and friends are merged with Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters #257's concurrent scan, discovery and vendor imports.
• Hints, CI, docker: unchanged. composer-compatibility.yml also triggers on crawlers/composer_crawler/**, utils/group_commit.rs and utils/durability.rs.
• Shared vectors: composer-version-vectors.json is byte-identical (cmp) to depscan's workspaces/lib/src/composer/patch-identity-vectors.json on SocketDev/depscan#26854.

🤖 Generated with Claude Code