Skip to content

chore(deps): allow mezzio-router 4.x - #12

Merged
tyrsson merged 1 commit into
1.0.xfrom
chore/widen-mezzio-router
Sep 25, 2026
Merged

tyrsson merged 1 commit into
1.0.xfrom
chore/widen-mezzio-router

Conversation

@tyrsson

@tyrsson tyrsson commented Sep 25, 2026

Copy link
Copy Markdown
Member

mezzio/mezzio-router was constrained to ^3.15 alone, so Composer could not resolve this package alongside anything on the router 4 line: it either failed outright or forced a downgrade to 3.20.0. That blocked adding any new dependency to applications that already sit on router 4.

Why this is safe

  • Precedent in the fleet. webware-acl already declares "mezzio/mezzio-router": "^3.15 || ^4.0", is locked to 4.2.0 and passes on it. Its RouteResource wraps a RouteResult and calls getMatchedRoute(), getMatchedParams() and getMatchedRouteName(), a deeper router surface than this package uses.
  • API audit. The entire router surface here is RouteCollectorInterface (getRoutes()), RouteResult (isFailure(), getMatchedRouteName()) and Route as a type hint. All three exist in 4.2.0. Nothing extends or implements RouteResult or Route, so 4.x making RouteResult final with a private constructor and fromRoute() / fromRouteFailure() factories is not a problem for this code.
  • The matched-route guard already handles 4.x's false|string return: is_string($matchedRouteName) && '' !== $matchedRouteName ? $matchedRouteName : null.
  • Mezzio\Router\RouteProviderInterface and Mezzio\MiddlewareFactoryInterface come from mezzio/mezzio, not mezzio-router, so the router major never touched them.
  • mezzio/mezzio itself permits ^3.15.0 || ^4.0.0, so this only makes our own constraint match its range.

Verification on 4.2.0

  • composer update mezzio/mezzio-router: 3.20.0 => 4.2.0, 0 installs, 0 removals, nothing else moved.
  • Unit: 23 tests, 42 assertions.
  • Integration: 1 test, 6 assertions.
  • mago format --check, mago lint, mago analyze, mago guard: clean.
  • Mutation: 82 mutants, 79 killed, 1 caught by static analysis, 2 escaped, MSI 97% against this repository's 95% gate.

Known debt, pre-existing and untouched here

Two mutants escape in src/NavigationContainer.php: Continue_ at line 158 and CastString at line 178. This change contains no PHP, so the mutant set is identical to before it; these are burn-down items rather than regressions.

The constraint was ^3.15 only, so Composer could not resolve this package
alongside anything on the router 4 line: it either failed or forced a
downgrade to 3.20.0.

ACL already carries ^3.15 || ^4.0 and passes on 4.2.0, and every router
symbol this package uses is unchanged in 4.x, so the constraint was the
only obstacle.

Verified on 4.2.0: unit 23/23, integration 1/1, mago format/lint/analyze/
guard clean, mutation MSI 97% against this repository's 95% gate.
@codecov

codecov Bot commented Sep 25, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@tyrsson tyrsson self-assigned this Sep 25, 2026
@tyrsson tyrsson added ims-migration Package moving out of the inventory-management-system application version: Next Major Lands on the next major branch labels Sep 25, 2026
@tyrsson
tyrsson merged commit 32cbff5 into 1.0.x Sep 25, 2026
12 checks passed
@tyrsson
tyrsson deleted the chore/widen-mezzio-router branch September 25, 2026 01:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ims-migration Package moving out of the inventory-management-system application version: Next Major Lands on the next major branch

Development

Successfully merging this pull request may close these issues.

1 participant