Skip to content

Conversation

@hostep
Copy link
Collaborator

@hostep hostep commented Jan 28, 2026

First attempt was to add --no-security-blocking flag to the composer update commands. But that may not be the best idea, not sure. It was removed again by now.

Rest of decisions here can be found in the later comments in the thread.

…h is needed since composer version 2.9.x, especially for older Magento versions since those have dependencies with known security vulnerabilities.
@shochdoerfer
Copy link
Member

I'd be fine removing the checks for older Magento versions. What do you think?

@hostep
Copy link
Collaborator Author

hostep commented Jan 28, 2026

Sure, it's going to be some extra small maintenance to keep them up2date every year when Magento drops support for a certain version, but I guess that's fine.

As for the phpstan failures it now complains about, I can fix half of them with these changes:

diff --git a/src/bitExpert/PHPStan/Magento/Autoload/ExtensionAutoloader.php b/src/bitExpert/PHPStan/Magento/Autoload/ExtensionAutoloader.php
index b97845f..859f69f 100644
--- a/src/bitExpert/PHPStan/Magento/Autoload/ExtensionAutoloader.php
+++ b/src/bitExpert/PHPStan/Magento/Autoload/ExtensionAutoloader.php
@@ -61,6 +61,8 @@ class ExtensionAutoloader implements Autoloader
             return;
         }

+        assert($class !== '');
+
         // fix for PHPStan 1.7.5 and later: Classes generated by autoloaders are supposed to "win" against
         // local classes in your project. We need to check first if classes exists locally before generating them!
         $pathToLocalClass = $this->classLoaderProvider->findFile($class);
diff --git a/src/bitExpert/PHPStan/Magento/Autoload/ExtensionInterfaceAutoloader.php b/src/bitExpert/PHPStan/Magento/Autoload/ExtensionInterfaceAutoloader.php
index e619323..16dda76 100644
--- a/src/bitExpert/PHPStan/Magento/Autoload/ExtensionInterfaceAutoloader.php
+++ b/src/bitExpert/PHPStan/Magento/Autoload/ExtensionInterfaceAutoloader.php
@@ -60,6 +60,8 @@ class ExtensionInterfaceAutoloader implements Autoloader
             return;
         }

+        assert($interfaceName !== '');
+
         // fix for PHPStan 1.7.5 and later: Classes generated by autoloaders are supposed to "win" against
         // local classes in your project. We need to check first if classes exists locally before generating them!
         $pathToLocalInterface = $this->classLoaderProvider->findFile($interfaceName);
diff --git a/src/bitExpert/PHPStan/Magento/Autoload/FactoryAutoloader.php b/src/bitExpert/PHPStan/Magento/Autoload/FactoryAutoloader.php
index 51630c2..0df926f 100644
--- a/src/bitExpert/PHPStan/Magento/Autoload/FactoryAutoloader.php
+++ b/src/bitExpert/PHPStan/Magento/Autoload/FactoryAutoloader.php
@@ -44,6 +44,8 @@ class FactoryAutoloader implements Autoloader
             return;
         }

+        assert($class !== '');
+
         // fix for PHPStan 1.7.5 and later: Classes generated by autoloaders are supposed to "win" against
         // local classes in your project. We need to check first if classes exists locally before generating them!
         $pathToLocalClass = $this->classLoaderProvider->findFile($class);
diff --git a/src/bitExpert/PHPStan/Magento/Autoload/ProxyAutoloader.php b/src/bitExpert/PHPStan/Magento/Autoload/ProxyAutoloader.php
index c4f0131..038c7f7 100644
--- a/src/bitExpert/PHPStan/Magento/Autoload/ProxyAutoloader.php
+++ b/src/bitExpert/PHPStan/Magento/Autoload/ProxyAutoloader.php
@@ -44,6 +44,8 @@ class ProxyAutoloader implements Autoloader
             return;
         }

+        assert($class !== '');
+
         // fix for PHPStan 1.7.5 and later: Classes generated by autoloaders are supposed to "win" against
         // local classes in your project. We need to check first if classes exists locally before generating them!
         $pathToLocalClass = $this->classLoaderProvider->findFile($class);

Do I include them in this PR, or rather in a separate one?

These are needed after phpstan/phpstan-src@9ab8480 happened.

The reason I'm using assert instead of specifying the strings as non-empty in the docblocks, is becuase if I do that, I run into yet another different problem (which may be a bug in phpstan itself): https://phpstan.org/r/aee143db-d568-4d6d-8a3a-f82ace294b8c

We could alternatively also just ignore those errors in the phpstan.neon file as it's not really important and clutters the code unnecessarily.

@shochdoerfer
Copy link
Member

Yeah, add the assert checks in this PR, I am fine with that. Using assert() is fine, at least the why is documented here.

Maybe open a bug report for PHPStan, the error feels wrong to me, but maybe Ondřej will disagree :)

I am quite busy this and the next week, so it will take me some time to merge and test.

@shochdoerfer
Copy link
Member

And as always, your help in improving the extension is very much welcome!

@hostep
Copy link
Collaborator Author

hostep commented Jan 29, 2026

@shochdoerfer, I've dropped Magento 2.4.4/2.4.5 and added 2.4.7/2.4.8 instead.
As for those non-empty string type errors from phpstan, I've just decided to ignore them, it makes little sense to add those ugly asserts in code, the issue is not big enough in my opinion to tackle properly.

I still have some failures in phpstan, but I don't know how to solve them, can you take a look when you find some time?

@hostep hostep changed the title Adds '--no-security-blocking' flag to 'composer update' commands whic… Try to fix broken tests Jan 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants