Dependency php-amqplib/php-amqplib vs php extension sockets causes inconsistent composer.lock file

[hostep]

Preconditions (*)

1. Magento 2.4-develop branch
2. PHP installation without the sockets extension installed

Steps to reproduce (*)

1. Clone the 2.4-develop branch (I'm using commit 90012f2)
2. Run composer install => notice it doesn't work:

$ composer install
Loading composer repositories with package information
Installing dependencies (including require-dev) from lock file
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - php-amqplib/php-amqplib v2.10.1 requires ext-sockets * -> the requested PHP extension sockets is missing from your system.
    - php-amqplib/php-amqplib v2.10.1 requires ext-sockets * -> the requested PHP extension sockets is missing from your system.
    - Installation request for php-amqplib/php-amqplib v2.10.1 -> satisfiable by php-amqplib/php-amqplib[v2.10.1].

3. Run composer update php-amqplib/php-amqplib => notice now it suddenly works:

$ composer update php-amqplib/php-amqplib
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 4 installs, 40 updates, 0 removals
  - Downgrading php-amqplib/php-amqplib (v2.10.1 => v2.7.3): Loading from cache
...

--

Now use a PHP installation which does have the sockets extension installed and try again:

1. Clone the 2.4-develop branch (I'm using commit 90012f2)
2. Run composer install => notice it works

Expected result (*)

1. Since the php extension sockets at this time is not required for a Magento installation, I would expect that we can install Magento without it installed

Actual result (*)

1. Can only install Magento without the sockets extension installed when running composer update, not when running composer install

Discussion

1. The big problem is that we now have the following constraint defined: "php-amqplib/php-amqplib": "~2.7.0||~2.10.0", in the composer.lock file
2. php-amqplib/php-amqplib version 2.7 does not need sockets, version 2.10 does need sockets
3. php-amqplib/php-amqplib requires the sockets extension since version 2.8.1

Solutions

Here are some possible solutions:

1. Document that the sockets extension is required in the documentation and remove the constraint ~2.7.0|| from the composer.json file
2. If we don't want the sockets extension to become required for Magento, we should change the constraint to: ~2.7.0
3. Make all developers of Magento use the exact same PHP installation (I know this is not realistic), so that when they runcomposer update it doesn't suddenly upgrade php-amqplib/php-amqplib to a version which might not work on other people's installations
   (it was corrected in 3d223517139#diff-1da2c7edc898c70e5a79a9997c98ceccL1392 and then changed again in 9f14f89#diff-1da2c7edc898c70e5a79a9997c98ceccL1393)

[m2-assistant]

Hi @hostep. Thank you for your report.
To help us process this issue please make sure that you provided the following information:

• Summary of the issue
• Information on your environment
• Steps to reproduce
• Expected and actual results

Please make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, please, add a comment to the issue:

@magento give me 2.4-develop instance - upcoming 2.4.x release

For more details, please, review the Magento Contributor Assistant documentation.

@hostep do you confirm that you were able to reproduce the issue on vanilla Magento instance following steps to reproduce?

• yes
• no

---

• Join Magento Community Engineering Slack and ask your questions in #github channel.

[melnikovi]

Sorry for the delay in response. I think that it's ok to add dependency on ext-sockets. We already updated documentation to highlight this. Do you have anymore concerns or this issue can be closed?

[hostep]

Hi @melnikovi

Yes, if ext-sockets becomes required, we should remove the version constraint ~2.7.0 for the php-amqplib/php-amqplib dependency in the composer.json file.

Otherwise when some Magento developer/contributor does not have ext-sockets installed and executes composer update it would downgrade the php-amqplib/php-amqplib again which leads to all unnecessary diffs in the composer.lock file and automatic tests suddenly using a different versions of that dependency again.

Do you agree?
I can send in a PR for this if you want.

[melnikovi]

Agree. Could you please submit PR to 2.4-develop branch? Thank you!