Component and root composer.json dependency floors can drift undetected

Start by comparing the root composer.json with each src//composer.json, then inspect the PHPUnit (PHP 8.3) (Symfony lowest) job that runs composer update --prefer-lowest. Define the check around shared third-party constraints, including the listed dangerous mismatches, while keeping sibling api-platform/ constraints out of scope. Done means CI fails when the root permits a version excluded by a component and covers the intended sibling-consistency decision.

Problem

A component's src/*/composer.json can declare a dependency floor that the root composer.json does not, and nothing detects the divergence.

The root package autoloads src/ directly rather than installing the split components, so src/*/composer.json is inert during a root composer update. Constraints declared there never enter the root resolution. The root's own constraints must therefore independently cover what the code under src/ requires — but that duplication is maintained by hand.

How it surfaced

In #8534, src/Doctrine/Orm/composer.json was raised to doctrine/orm: ^2.17 || ^3.3, because Doctrine\ORM\Query\AST\PartialObjectExpression and the PARTIAL DQL grammar do not exist in 3.0.0–3.2.3. The root composer.json was left at ^2.17 || ^3.0.

The PHPUnit (PHP 8.3) (Symfony lowest) job runs composer update --prefer-lowest at the repo root, so it kept installing doctrine/orm 3.0.1 — a version the component itself declares unsupported. EagerLoadingExtension emitted partial x.{...} into a parser with no such grammar, and two ContextSwitchTest cases failed with:

[Syntax Error] line 0, col 38: Expected Doctrine\ORM\Query\TokenType::T_FROM, got '.'

raised from Paginator::getCountQuery().

Nothing pointed at the cause. The job that failed was not the job the change was meant to fix, the component's own test suite was green, and the failure looked like a version-resolution or flakiness problem before the root/component split turned out to be responsible.

Current state

A scan comparing every third-party constraint in src/*/composer.json against the root's finds 17 mismatches. Most are benign — the root is stricter than the component, e.g. symfony/serializer at ^7.4.9 || ^8.0.9 vs ^7.4 in eleven components.

The dangerous direction is the root being looser than a component, which is what bit #8534. Present examples:

And #8534 left two siblings behind that should probably move with it:

Proposal

A CI check that compares shared third-party constraints between the root composer.json and each src/*/composer.json, failing when the root permits a version a component excludes. Sibling api-platform/* constraints are out of scope — those legitimately differ, since the root uses self.version.

Whether components should also be kept consistent with each other (the Doctrine/Common vs Doctrine/Orm case above) is a separate question worth deciding as part of this.