Unable to pull high version

[ennnnny]

Hello!

I'm having a problem with it. At the time of my posting, the highest version of symfony/cache that matches my environment is v6.4.2, but when I go to update it via velocita, I keep getting v6.4.0.

I tried to access https://VELOCITA_URL/mirror/packagist/p2/symfony/cache.json and there is v6.4.2 version info in there!

Of course I tried to use composer update symfony/cache --no-cache to update it, but still can't get the high version.

for example：

Loading plugin ISAAC\Velocita\Composer\VelocitaPlugin (from isaac/composer-velocita, installed globally)
Downloading https://VELOCITA_URL/mirrors.json
[200] https://VELOCITA_URL/mirrors.json
> pre-command-run: ISAAC\Velocita\Composer\VelocitaPlugin->onPreCommandRun
Reading ./composer.lock (/Users/kuye/workspace/dialogue_server/composer.lock)
Loading composer repositories with package information
> pre-file-download: ISAAC\Velocita\Composer\VelocitaPlugin->onPreFileDownload
ISAAC\Velocita\Composer\VelocitaPlugin::onPreFileDownload(url=https://repo.packagist.org/packages.json): mapped to https://VELOCITA_URL/mirror/packagist/packages.json
Downloading https://VELOCITA_URL/mirror/packagist/packages.json
[200] https://VELOCITA_URL/mirror/packagist/packages.json
> pre-file-download: ISAAC\Velocita\Composer\VelocitaPlugin->onPreFileDownload
ISAAC\Velocita\Composer\VelocitaPlugin::onPreFileDownload(url=https://repo.packagist.org/p2/symfony/cache.json): mapped to https://VELOCITA_URL/mirror/packagist/p2/symfony/cache.json
Downloading https://VELOCITA_URL/mirror/packagist/p2/symfony/cache.json
[200] https://VELOCITA_URL/mirror/packagist/p2/symfony/cache.json
Built pool.
Running pool optimizer.
Pool optimizer completed in 0.007 seconds
Found 266 package versions referenced in your dependency graph. 12 (5%) were optimized away.
Updating dependencies
Generating rules
Resolving dependencies through SAT
Looking at all rules.

Dependency resolution completed in 0.001 seconds
Analyzed 254 packages to resolve dependencies
Analyzed 626 rules to resolve dependencies
Nothing to modify in lock file
Generating rules
Resolving dependencies through SAT
Looking at all rules.

Dependency resolution completed in 0.001 seconds
Installing dependencies from lock file (including require-dev)
Nothing to install, update or remove

When I turn off composer velocita:disable, I can update to v6.4.2 normally!

What should I do?

[gmta]

Hi! Thanks for the report; could you share your Velocita config and composer.json that you are using with me please?

[ennnnny]

Velocita config:

##
# Mirrors configuration
##

# GitHub codeload
MIRROR_GITHUB_CODELOAD_URL=https://codeload.github.com
MIRROR_GITHUB_CODELOAD_CACHE_SIZE=3g

# Packagist
MIRROR_PACKAGIST_URL=https://repo.packagist.org
MIRROR_PACKAGIST_TYPE=composer
MIRROR_PACKAGIST_CACHE_EXPIRY=182d
MIRROR_PACKAGIST_CACHE_SIZE=3g

composer.json

{
    "name": "laravel/laravel",
    "type": "project",
    "description": "The skeleton application for the Laravel framework.",
    "keywords": ["laravel", "framework"],
    "license": "MIT",
    "require": {
        "php": "^8.1",
        "ext-bcmath": "*",
        "ext-openssl": "*",
        "godruoyi/php-snowflake": "^3.0",
        "guzzlehttp/guzzle": "^7.2",
        "itinysun/laraman": "^2.0",
        "jiannei/laravel-response": "^5.0",
        "laravel/framework": "^10.10",
        "laravel/octane": "^2.2",
        "laravel/sanctum": "^3.2",
        "laravel/telescope": "^4.15",
        "laravel/tinker": "^2.8",
        "owen-oj/laravel-getid3": "^2.2",
        "slowlyo/owl-admin": "^3.0",
        "slowlyo/owl-amis-json-parse": "^1.1",
        "slowlyo/owl-dict": "^1.1",
        "slowlyo/owl-login-guard": "^1.1",
        "slowlyo/owl-operation-log": "^0.1.0",
        "slowlyo/owl-system-backup": "^0.3.0",
        "vinkla/hashids": "^11.0",
        "w7corp/easywechat": "^6.12"
    },
    "require-dev": {
        "fakerphp/faker": "^1.9.1",
        "larastan/larastan": "^2.7",
        "laravel-lang/common": "^3.1",
        "laravel/pint": "^1.10",
        "laravel/sail": "^1.18",
        "mockery/mockery": "^1.4.4",
        "nunomaduro/collision": "^7.0",
        "phpunit/phpunit": "^10.1",
        "spatie/laravel-ignition": "^2.0"
    },
    "autoload": {
        "psr-4": {
            "App\\": "app/",
            "Database\\Factories\\": "database/factories/",
            "Database\\Seeders\\": "database/seeders/"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "Tests\\": "tests/"
        }
    },
    "scripts": {
        "post-autoload-dump": [
            "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
            "@php artisan package:discover --ansi"
        ],
        "post-update-cmd": [
            "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
        ],
        "post-root-package-install": [
            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
        ],
        "post-create-project-cmd": [
            "@php artisan key:generate --ansi"
        ],
        "analyse": "phpstan analyse --memory-limit=3G",
        "cs-fix": "pint"
    },
    "extra": {
        "laravel": {
            "dont-discover": []
        }
    },
    "config": {
        "optimize-autoloader": true,
        "preferred-install": "dist",
        "sort-packages": true,
        "allow-plugins": {
            "pestphp/pest-plugin": true,
            "php-http/discovery": true
        }
    },
    "minimum-stability": "stable",
    "prefer-stable": true
}

Things like slowlyo/owl-admin are also not upgradable to the higher version v3.1.3.

[gmta]

Could you try to add the following Velocita setting and let me know if that resolves the issue?

MIRROR_PACKAGIST_ALLOW_REVALIDATE=true

If that works, I might need to update the default value for this. I think it was introduced because Packagist used to generate unique package JSON URLs between updates, but they no longer do so with the p2 version of their URL scheme.

[ennnnny]

Could you try to add the following Velocita setting and let me know if that resolves the issue?

MIRROR_PACKAGIST_ALLOW_REVALIDATE=true

If that works, I might need to update the default value for this. I think it was introduced because Packagist used to generate unique package JSON URLs between updates, but they no longer do so with the p2 version of their URL scheme.

But my visit to https://VELOCITA_URL/mirror/packagist/p2/symfony/cache.json has the high version info in it, which is consistent with packagist.org, so that shouldn't be the problem

[gmta]

Please try my suggestion regardless; Composer might send a different request than your manual one.

[ennnnny]

MIRROR_PACKAGIST_ALLOW_REVALIDATE=true

OK, I modified the .env file, added MIRROR_PACKAGIST_ALLOW_REVALIDATE=true and restarted the docker container.

I tried using composer update slowlyo/owl-admin --no-cache -vvv and it still didn't work.

Some of the logs are as follows

$ composer update slowlyo/owl-admin --no-cache -vvv 
Disabling cache usage
Running 2.6.6 (2023-12-08 18:32:26) with PHP 8.2.14 on Darwin / 23.2.0
> pre-file-download: ISAAC\Velocita\Composer\VelocitaPlugin->onPreFileDownload
ISAAC\Velocita\Composer\VelocitaPlugin::onPreFileDownload(url=https://repo.packagist.org/packages.json): mapped to https://VELOCITA_URL/mirror/packagist/packages.json
Downloading https://VELOCITA_URL/mirror/packagist/packages.json
[200] https://VELOCITA_URL/mirror/packagist/packages.json
> pre-file-download: ISAAC\Velocita\Composer\VelocitaPlugin->onPreFileDownload
ISAAC\Velocita\Composer\VelocitaPlugin::onPreFileDownload(url=https://repo.packagist.org/p2/slowlyo/owl-admin.json): mapped to https://VELOCITA_URL/mirror/packagist/p2/slowlyo/owl-admin.json
Downloading https://VELOCITA_URL/mirror/packagist/p2/slowlyo/owl-admin.json
[200] https://VELOCITA_URL/mirror/packagist/p2/slowlyo/owl-admin.json
Built pool.
Running pool optimizer.
Lock file operations: 0 installs, 1 update, 0 removals
Updates: slowlyo/owl-admin:v3.1.2
  - Downgrading slowlyo/owl-admin (v3.1.3 => v3.1.2)
Writing lock file
Updates: slowlyo/owl-admin:v3.1.2
> pre-file-download: ISAAC\Velocita\Composer\VelocitaPlugin->onPreFileDownload
ISAAC\Velocita\Composer\VelocitaPlugin::onPreFileDownload(url=https://api.github.com/repos/Slowlyo/owl-admin/zipball/3f0ab7e6daf7cd48416e9ba8973c21873dd9ac6a): mapped to https://VELOCITA_URL/mirror/github-codeload/Slowlyo/owl-admin/legacy.zip/3f0ab7e6daf7cd48416e9ba8973c21873dd9ac6a
  - Downloading slowlyo/owl-admin (v3.1.2)
Downloading https://VELOCITA_URL/mirror/github-codeload/Slowlyo/owl-admin/legacy.zip/3f0ab7e6daf7cd48416e9ba8973c21873dd9ac6a
[200] https://VELOCITA_URL/mirror/github-codeload/Slowlyo/owl-admin/legacy.zip/3f0ab7e6daf7cd48416e9ba8973c21873dd9ac6a
  - Downgrading slowlyo/owl-admin (v3.1.3 => v3.1.2): Extracting archive

The version was rolled back.

Meanwhile, my browser opens up to https://VELOCITA_URL/mirror/packagist/p2/slowlyo/owl-admin.json and the result is partly as follows

{"minified": "composer/2.0","packages": {"slowlyo/owl-admin": [{"name": "slowlyo/owl-admin","description": "基于 laravel、amis 开发的后台框架~","keywords": ["admin", "laravel", "amis", "OwlAdmin"],"homepage": "https://github.com/slowlyo/owl-admin","version": "v3.1.3","version_normalized": "3.1.3.0","license": ["MIT"],"authors": [{"name": "Slowlyo","email": "[email protected]","homepage": "https://gitee.com/slowlyo"}],"source": {"url": "https://github.com/Slowlyo/owl-admin.git","type": "git","reference": "9d4bbe61ca6545e694c48dd63502dbe0d57ed393"},"dist": {"url": "https://api.github.com/repos/Slowlyo/owl-admin/zipball/9d4bbe61ca6545e694c48dd63502dbe0d57ed393","type": "zip","shasum": "","reference": "9d4bbe61ca6545e694c48dd63502dbe0d57ed393"},"type": "library","time": "2023-12-30T14:14:57+00:00","autoload": {"files": ["src/Support/helpers.php"],"psr-4": {"Slowlyo\\OwlAdmin\\": "src/"}},"extra": {"laravel": {"providers": ["Slowlyo\\OwlAdmin\\AdminServiceProvider"],"aliases": {"OwlAdmin": "Slowlyo\\OwlAdmin\\Facades\\OwlAdmin"}}},"require": {"php": ">=8.0","illuminate/support": "~9|~10"},"support": {"issues": "https://github.com/Slowlyo/owl-admin/issues","source": "https://github.com/Slowlyo/owl-admin/tree/v3.1.3"}}]}}

[gmta]

Thanks for all the information and apologies for the delay in coming back to you - I've been trying on and off to replicate your issue but have been unable to do so. Are you able to provide reproduction steps starting with a new Velocita instance?