Skip to content

Update changelog-generator dependencies - #6845

Merged
ondrejmirtes merged 5 commits into
2.3.xfrom
update-changelog-generator
Oct 26, 2026
Merged

ondrejmirtes merged 5 commits into
2.3.xfrom
update-changelog-generator

Conversation

@ondrejmirtes

Copy link
Copy Markdown
Member

Updates changelog-generator dependencies in small steps, one commit per step:

  1. Latest minor and patch versions, including the Guzzle security fixes (7.8.0 → 7.16.1)
  2. Stop requiring the root vendor/autoload.php in run.php. That autoloader is prepended, so symfony/console and guzzlehttp/guzzle were loaded from phpstan-src's own vendor directory (Console 5.4, Guzzle 7.15), not from changelog-generator/composer.lock. Without this, the updates below would have no effect at runtime.
  3. symfony/console 7.4 (requires PHP 8.2): adds the int return type Command::execute() now declares and replaces the deprecated Application::add() with addCommand()
  4. symfony/console 8 (requires PHP 8.4). The workflow now runs on PHP 8.4.
  5. guzzlehttp/guzzle 8, dropping the unused http-interop/http-factory-guzzle, which does not allow guzzlehttp/psr7 3. php-http/discovery now finds GuzzleHttp\Psr7\HttpFactory and GuzzleHttp\Client.

Verification: after every step I generated the changelog for the last 6 commits of 2.3.x against the real GitHub API (php run.php 7d3ede5c3~6 7d3ede5c3). The output was identical to the output before any change. --include-headings still prints the headings. ../bin/phpstan reports no errors after every step.

Supersedes #6734 and the changelog-generator part of #5920.

run.php also required the root vendor/autoload.php. That autoloader is
prepended, so symfony/console and guzzlehttp/guzzle were loaded from
phpstan-src's own vendor directory instead of the versions in
changelog-generator/composer.lock. The generator does not use anything
else from the root vendor directory.

Amp-Thread-ID: https://ampcode.com/threads/T-01a176c6-528a-7430-b296-e66930d153b4
http-interop/http-factory-guzzle does not allow guzzlehttp/psr7 3. It is
not needed: php-http/discovery finds the PSR-17 factories in
guzzlehttp/psr7 itself.

Amp-Thread-ID: https://ampcode.com/threads/T-01a176c6-528a-7430-b296-e66930d153b4
@ondrejmirtes
ondrejmirtes merged commit 7e600f5 into 2.3.x Oct 26, 2026
717 checks passed
@ondrejmirtes
ondrejmirtes deleted the update-changelog-generator branch October 26, 2026 06:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant