Merge branch 'hotfix/1.8.5'

Author: turegjorup

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.8.5] - 2025-02-14
+
+- Change to `composer/semver` to fix advisories mapping
+
 ## [1.8.4] - 2025-02-14
 
 - Fix server edit/create bug

composer.json

@@ -8,6 +8,7 @@
         "ext-ctype": "*",
         "ext-iconv": "*",
         "api-platform/core": "^4.0",
+        "composer/semver": "^3.4",
         "doctrine/dbal": "^4.0",
         "doctrine/doctrine-bundle": "^2.13",
         "doctrine/doctrine-migrations-bundle": "^3.4",
@@ -40,8 +41,7 @@
         "symfony/uid": "^7.2",
         "symfony/validator": "^7.2",
         "symfony/webpack-encore-bundle": "^2.0",
-        "symfony/yaml": "^7.2",
-        "z4kn4fein/php-semver": "^3.0"
+        "symfony/yaml": "^7.2"
     },
     "require-dev": {
         "ergebnis/composer-normalize": "^2.23",

composer.lock

@@ -27,12 +27,9 @@ services:
       - "host.docker.internal:host-gateway"
     volumes:
       - .:/app
-      - ../../shared/.env.local:/app/.env.local
     depends_on:
       - rabbit
 
   phpfpm:
-    volumes:
-      - ../../shared/.env.local:/app/.env.local
     depends_on:
       - rabbit

docker-compose.server.override.yml

@@ -0,0 +1,8 @@
+services:
+  supervisor:
+    volumes:
+      - ../../shared/.env.local:/app/.env.local
+
+  phpfpm:
+    volumes:
+      - ../../shared/.env.local:/app/.env.local

docker-compose.server.prod.yml

@@ -9,10 +9,8 @@
 use App\Entity\Package;
 use App\Entity\PackageVersion;
 use App\Repository\AdvisoryRepository;
+use Composer\Semver\Semver;
 use Doctrine\ORM\EntityManagerInterface;
-use z4kn4fein\SemVer\Constraints\Constraint;
-use z4kn4fein\SemVer\SemverException;
-use z4kn4fein\SemVer\Version;
 
 class AdvisoryFactory
 {
@@ -91,14 +89,8 @@ private function getInstalledPackageVersion(Installation $installation, string $
     private function setAdvisoryForAffectedVersions(Package $package, Advisory $advisory): void
     {
         foreach ($package->getPackageVersions() as $packageVersion) {
-            try {
-                $constraint = Constraint::parse($advisory->getAffectedVersions());
-                $version = Version::parse($packageVersion->getVersion(), false);
-                if ($constraint->isSatisfiedBy($version)) {
-                    $advisory->addPackageVersion($packageVersion);
-                }
-            } catch (SemverException) {
-                // Ignore
+            if (Semver::satisfies($packageVersion->getVersion(), $advisory->getAffectedVersions())) {
+                $advisory->addPackageVersion($packageVersion);
             }
         }
     }