From c88944683743ee0babb6da9426bcdeb9a21f1e14 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:14:59 +0200 Subject: [PATCH 01/24] deployer: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/de/deployer/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/de/deployer/package.nix b/pkgs/by-name/de/deployer/package.nix index c75b5e1d27a7..9423c04e1a55 100644 --- a/pkgs/by-name/de/deployer/package.nix +++ b/pkgs/by-name/de/deployer/package.nix @@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: { hash = "sha256-wtkixHexsJNKsLnnlHssh0IzxwWYMPKDcaf/D0zUNKk="; }; - vendorHash = "sha256-0uBI30n31W0eDVA9/W366O0Qo2jWZBqEL+YbJx4J7P0="; + vendorHash = "sha256-/bf1rvoG1N6GNqisBwMqY05qhTsy7gMeWXarXgElU/M="; meta = { changelog = "https://github.com/deployphp/deployer/releases/tag/v${finalAttrs.version}"; From 4eee7a99dfaa9dcee3eea6c69e79481a2523d573 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:15:33 +0200 Subject: [PATCH 02/24] composer-require-checker: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/co/composer-require-checker/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/co/composer-require-checker/package.nix b/pkgs/by-name/co/composer-require-checker/package.nix index 1a914083b8d8..239debebbb08 100644 --- a/pkgs/by-name/co/composer-require-checker/package.nix +++ b/pkgs/by-name/co/composer-require-checker/package.nix @@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: { hash = "sha256-UAofdc8mqSnJXhCTABSf9JZERqur86lzNDI66EHgEQE="; }; - vendorHash = "sha256-bNeQEfwXly3LFuEKeSK6J6pRfQF6TNwUqu3SdTswmFI="; + vendorHash = "sha256-TlBrL4KyMVHaxqlfvnTkj3TkmU8h5/0BRC5e8yWrhCI="; doInstallCheck = true; nativeInstallCheckInputs = [ versionCheckHook ]; From 5bb0fdf52c78a962e2dfbbd4ec3154b1dca5f247 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:16:06 +0200 Subject: [PATCH 03/24] roave-backward-compatibility-check: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/ro/roave-backward-compatibility-check/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix index 3200cfe2af7e..2c1c0a83957d 100644 --- a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix +++ b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix @@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: { hash = "sha256-4rhIaPdyyLiIhVYC4KNKbPAbVsHKnK6BOsebFjmmDeI="; }; - vendorHash = "sha256-k+zFpBHE+r0a67gqUry+luMIhJZ5wo1RpEaF4c7vAmI="; + vendorHash = "sha256-uZqstfVp5uY7Sec32XLK7RvuUtP8Hj21W7tayhhuf2g="; nativeInstallCheckInputs = [ versionCheckHook From a7b12f2bd9e01ceab9247eeb7acfe9a2c40290b3 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:16:25 +0200 Subject: [PATCH 04/24] robo: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/ro/robo/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ro/robo/package.nix b/pkgs/by-name/ro/robo/package.nix index c1e0ee1fc92c..480fe8ebeb24 100644 --- a/pkgs/by-name/ro/robo/package.nix +++ b/pkgs/by-name/ro/robo/package.nix @@ -16,7 +16,7 @@ php82.buildComposerProject2 (finalAttrs: { hash = "sha256-bAT4jHvqWeYcACeyGtBwVBA2Rz+AvkZcUGLDwSf+fLg="; }; - vendorHash = "sha256-vketnTu5VEgt3HBbtnTppWl3+sSSIsCB2MpvL27bxv4="; + vendorHash = "sha256-Rg8WTZUnWA4bemNmE7hxFwfnlMtYyPkeltAQEWJ2VDU="; nativeInstallCheckInputs = [ versionCheckHook From 2040e5f2f004ebb649176c99033bbb483a2a62bb Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:16:41 +0200 Subject: [PATCH 05/24] pdepend: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/pd/pdepend/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/pd/pdepend/package.nix b/pkgs/by-name/pd/pdepend/package.nix index aa72fe80e91f..d8bd332f8fbe 100644 --- a/pkgs/by-name/pd/pdepend/package.nix +++ b/pkgs/by-name/pd/pdepend/package.nix @@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: { }; composerLock = ./composer.lock; - vendorHash = "sha256-szKVZhWcd8p4307irNqgSAK2+hl8AW+gCPyf0EEco8A="; + vendorHash = "sha256-uK+nJFXDVPYFbosAUxqu+mmNsD7AnZ18NnIN9FYAaPQ="; nativeInstallCheckInputs = [ versionCheckHook ]; doInstallCheck = true; From 4dc2b25c7e3d92824e07d3dcef71ee450e470ade Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:17:13 +0200 Subject: [PATCH 06/24] flarum: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/fl/flarum/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/fl/flarum/package.nix b/pkgs/by-name/fl/flarum/package.nix index 9d83dacbca08..0043123e347b 100644 --- a/pkgs/by-name/fl/flarum/package.nix +++ b/pkgs/by-name/fl/flarum/package.nix @@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: { composerLock = ./composer.lock; composerStrictValidation = false; - vendorHash = "sha256-pup+ZfPEnqoA3wEXQNn4pWTYXri6d4XzMfuc8k1SeQk="; + vendorHash = "sha256-4wB8MRnqnruo9VXupMmAqiRSZx8F2i+8zcOphTeDp1g="; meta = with lib; { changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md"; From 5bc93153a8f0d4c806dd64cdd5ffdcf695218d13 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:17:38 +0200 Subject: [PATCH 07/24] movim: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/mo/movim/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/mo/movim/package.nix b/pkgs/by-name/mo/movim/package.nix index 0cb5ed73e7f4..06d7be4dd40b 100644 --- a/pkgs/by-name/mo/movim/package.nix +++ b/pkgs/by-name/mo/movim/package.nix @@ -88,7 +88,7 @@ php.buildComposerProject2 (finalAttrs: { ++ lib.optional minify.style.enable lightningcss ++ lib.optional minify.svg.enable scour; - vendorHash = "sha256-xkFyjs3jW7j+8WosRaxBEYQU2dwQlDr4/nrdtW03xvA="; + vendorHash = "sha256-Ke+bh/mvKUk5qxjlBZo4jJhLneyFRq0HYXTwK/KZMBs="; postPatch = '' # Our modules are already wrapped, removes missing *.so warnings; From 7bd88ff6e3dfc82c54351df2a35f29256d92f431 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:18:13 +0200 Subject: [PATCH 08/24] agorakit: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/ag/agorakit/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ag/agorakit/package.nix b/pkgs/by-name/ag/agorakit/package.nix index c1c9595eccac..c5f8c722327d 100644 --- a/pkgs/by-name/ag/agorakit/package.nix +++ b/pkgs/by-name/ag/agorakit/package.nix @@ -27,7 +27,7 @@ php82.buildComposerProject2 (finalAttrs: { runHook postInstall ''; - vendorHash = "sha256-tBB3Zl/N1XqPTD84at5WoGrD0G5rJbobk4E8BFOSm+M="; + vendorHash = "sha256-cg9OIBvWX69yU6U6Ag/T3jScG2OUdpTqc+KwP6VyUHo="; composerStrictValidation = false; passthru.updateScript = nix-update-script { }; From 8b54db6167dc7cb36b28a9309d386929852b003b Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:18:35 +0200 Subject: [PATCH 09/24] engelsystem: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/en/engelsystem/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/en/engelsystem/package.nix b/pkgs/by-name/en/engelsystem/package.nix index 27a089230b82..7da12fd84620 100644 --- a/pkgs/by-name/en/engelsystem/package.nix +++ b/pkgs/by-name/en/engelsystem/package.nix @@ -23,7 +23,7 @@ php.buildComposerProject2 (finalAttrs: { inherit php; - vendorHash = "sha256-0Mv48mB/pTQtYd2do6wTdhD/c2zwbU1gTYsdU7rELPY="; + vendorHash = "sha256-ODJgsvECw+q3sAA6pWNw4X2Png7f4G2Jty9AQSj/SgE="; composoerNoDev = true; composerStrictValidation = false; From 5f83b2cbd64687afa211bfb03fb050ae9f18eba2 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:19:15 +0200 Subject: [PATCH 10/24] pest: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/pe/pest/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/pe/pest/package.nix b/pkgs/by-name/pe/pest/package.nix index 6cc3bbb88e97..a5be5a24b227 100644 --- a/pkgs/by-name/pe/pest/package.nix +++ b/pkgs/by-name/pe/pest/package.nix @@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: { }; composerLock = ./composer.lock; - vendorHash = "sha256-rOJ6PFp4Xfe89usoH455EAT30d2Tu3zd3+C/6K/kGBw="; + vendorHash = "sha256-4CpyerXmfXbwsNsK16V+GY3Rzo4BfavGpOVITD14p8w="; meta = { changelog = "https://github.com/pestphp/pest/releases/tag/v${finalAttrs.version}"; From b9f3829c78bc6f79f6fea0b3299549eb6b2a3d9b Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:19:30 +0200 Subject: [PATCH 11/24] pretty-php: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/pr/pretty-php/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/pr/pretty-php/package.nix b/pkgs/by-name/pr/pretty-php/package.nix index 35a132174ecc..3e8a806249f8 100644 --- a/pkgs/by-name/pr/pretty-php/package.nix +++ b/pkgs/by-name/pr/pretty-php/package.nix @@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: { hash = "sha256-zBhxuEViLxeQ9m3u1L0wYqeL+YEWWwvJS7PtsFPO5QU="; }; - vendorHash = "sha256-vnmp/HLzaOzHu22lzugRXIHL43YQ/hm223gcUbIiLT4="; + vendorHash = "sha256-Y1/wNFPXza2aO07ZFybpwI3XbTVBhEvFHs9ygHQbcSo="; passthru = { tests.version = testers.testVersion { From 47d251327cc876f675e6a61af8eb94b6f284e033 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:19:46 +0200 Subject: [PATCH 12/24] phpactor: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/ph/phpactor/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ph/phpactor/package.nix b/pkgs/by-name/ph/phpactor/package.nix index 402970157526..96310ff421b7 100644 --- a/pkgs/by-name/ph/phpactor/package.nix +++ b/pkgs/by-name/ph/phpactor/package.nix @@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: { hash = "sha256-9XWlWwq+xvqPgKIc7IGoMVTxajjYsrPo/ra/0JIE168="; }; - vendorHash = "sha256-3xkt0QjytW4BOCgZdevat7zkSuZTPPvwz3yptiq5zoo="; + vendorHash = "sha256-91Yz78nh4r+Gr7gKSwelTdO436ehENVTPUWcnDaU7zg="; nativeBuildInputs = [ installShellFiles ]; From ae68d8ca7b44ca06aaa27b363ae7ceaa02ad1a01 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:20:09 +0200 Subject: [PATCH 13/24] phpdocumentor: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/ph/phpdocumentor/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ph/phpdocumentor/package.nix b/pkgs/by-name/ph/phpdocumentor/package.nix index 92e583031735..6026aacb1073 100644 --- a/pkgs/by-name/ph/phpdocumentor/package.nix +++ b/pkgs/by-name/ph/phpdocumentor/package.nix @@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: { hash = "sha256-iQA19FrXvVLzg+LaY1BcNmG8amMfKPVFwYbZ7dr+H9Q="; }; - vendorHash = "sha256-sFRy9Hy9CVNjjYqbPbKH0XhoUdu4HlkiuHDDovTGono="; + vendorHash = "sha256-iXkj0Pa4ln8GX/ARCpnijaWdFM4VYZuj42RP0GS2LW8="; nativeBuildInputs = [ makeBinaryWrapper ]; From 5e1ac99aecc40d07fde85a2b9391bddfd40c6088 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:20:28 +0200 Subject: [PATCH 14/24] grocy: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/by-name/gr/grocy/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/gr/grocy/package.nix b/pkgs/by-name/gr/grocy/package.nix index ee2b76bd91a4..94fc34a56679 100644 --- a/pkgs/by-name/gr/grocy/package.nix +++ b/pkgs/by-name/gr/grocy/package.nix @@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: { hash = "sha256-MnN6TIkNZWT+pAQf0+z5l3hj/7K/d3BfI7VAaUEKG8s="; }; - vendorHash = "sha256-n+6yNXqarWRZt6VEuHrFe3nrTiGeHnkURmO2UuB/BVc="; + vendorHash = "sha256-6vWV8+4tETUFBLeEoG7d8lHKILXvM7ezWbDiG11GA/s="; offlineCache = fetchYarnDeps { yarnLock = finalAttrs.src + "/yarn.lock"; From 13b803083352825427606958e0b5545cf1303942 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:25:37 +0200 Subject: [PATCH 15/24] psysh: mark as broken, remove teams.php I'm strongly against the PHP team maintaining packages just because they happen to be written in PHP. Also, $ nix-build -A psysh.composerVendor --check checking outputs of '/nix/store/1mpgxnyzw18bv824drzi05k6mxb9znss-psysh-composer-vendor-0.12.7.drv'... /nix/store/nxza0ss75gbgwycsld0gyw1m729271j9-composer-vendor-hook.sh/nix-support/setup-hook: line 13: composerNoDev: unbound variable error: builder for '/nix/store/1mpgxnyzw18bv824drzi05k6mxb9znss-psysh-composer-vendor-0.12.7.drv' failed with exit code 1 Marking as broken until somebody picks it up and performs a proper fix. --- pkgs/by-name/ps/psysh/package.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/ps/psysh/package.nix b/pkgs/by-name/ps/psysh/package.nix index 709efc36a5f4..a286afa171f5 100644 --- a/pkgs/by-name/ps/psysh/package.nix +++ b/pkgs/by-name/ps/psysh/package.nix @@ -58,6 +58,7 @@ php.buildComposerProject2 (finalAttrs: { mainProgram = "psysh"; license = lib.licenses.mit; homepage = "https://psysh.org/"; - teams = [ lib.teams.php ]; + # `composerVendor` doesn't build + broken = true; }; }) From 9120cb1f396e977bab3f1e6b4bbaa66265a2b8bf Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:28:09 +0200 Subject: [PATCH 16/24] baikal: mark as broken The diff between expected and got path is --- /nix/store/7ci5x0qh7vzcqk7pnhdzbqcsr6mp0km3-baikal-composer-vendor-0.10.1/vendor/bin/sabredav 1970-01-01 01:00:01.000000000 +0100 +++ /nix/store/1r5n9z4xkbs33zwbdz7sh2ys1vaqphc8-baikal-composer-vendor-0.10.1/vendor/bin/sabredav 1970-01-01 01:00:01.000000000 +0100 @@ -7,7 +7,7 @@ selfArg="$0" fi -self=$(realpath $selfArg 2> /dev/null) +self=$(realpath "$selfArg" 2> /dev/null) if [ -z "$self" ]; then self="$selfArg" fi This is not explainable by the composer update. Hence, marking as broken until the maintainers figure out a solution. --- pkgs/by-name/ba/baikal/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ba/baikal/package.nix b/pkgs/by-name/ba/baikal/package.nix index 32213d3922ff..08103ccf5225 100644 --- a/pkgs/by-name/ba/baikal/package.nix +++ b/pkgs/by-name/ba/baikal/package.nix @@ -21,5 +21,7 @@ php.buildComposerProject2 (finalAttrs: { homepage = "https://sabre.io/baikal/"; license = lib.licenses.gpl3Only; maintainers = with lib.maintainers; [ wrvsrx ]; + # vendorHash non-reproducible + broken = true; }; }) From 6a97a2344c10672dbaafd452c8b79f47068bd522 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:36:05 +0200 Subject: [PATCH 17/24] phpPackages.phive: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/development/php-packages/phive/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/php-packages/phive/default.nix b/pkgs/development/php-packages/phive/default.nix index 5d0a9f26b1b3..35c108c5200d 100644 --- a/pkgs/development/php-packages/phive/default.nix +++ b/pkgs/development/php-packages/phive/default.nix @@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: { hash = "sha256-dv9v1KCLNheFmrRQ7cID5WFvoiH0OWVPWSrN023dEqA="; }; - vendorHash = "sha256-H1QJ+ML0tbZzEBKknP0GHhUhw+ujiIH/QNmEgA2zSmM="; + vendorHash = "sha256-U6BHAd4tWQKm6uCJ5sM51PltXhF3J4ieTnbC060+8Jg="; meta = { changelog = "https://github.com/phar-io/phive/releases/tag/${finalAttrs.version}"; From 78c0fd2b0888d2badae3448afcaeed7e8194ba36 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:36:19 +0200 Subject: [PATCH 18/24] phpPackages.php-parallel-lint: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/development/php-packages/php-parallel-lint/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/php-packages/php-parallel-lint/default.nix b/pkgs/development/php-packages/php-parallel-lint/default.nix index bed0420642c7..e7f93224f1ab 100644 --- a/pkgs/development/php-packages/php-parallel-lint/default.nix +++ b/pkgs/development/php-packages/php-parallel-lint/default.nix @@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: { }; composerLock = ./composer.lock; - vendorHash = "sha256-ySdLlqlGKZ6LgmAOBMkBNoCAqWrgMwE/Cj6ZEPEsCko="; + vendorHash = "sha256-AQAASj5vrSE1xkJ/SZHU4GwOWNobe9ES0Yo+YrLH354="; nativeInstallCheckInputs = [ versionCheckHook ]; doInstallCheck = true; From 52568d69618a9f96b3fc75331417ae9e56e80dcf Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:36:37 +0200 Subject: [PATCH 19/24] phpPackages.phpinsights: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/development/php-packages/phpinsights/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/php-packages/phpinsights/default.nix b/pkgs/development/php-packages/phpinsights/default.nix index 5562277b4cd7..13d0ebf7b640 100644 --- a/pkgs/development/php-packages/phpinsights/default.nix +++ b/pkgs/development/php-packages/phpinsights/default.nix @@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: { }; composerLock = ./composer.lock; - vendorHash = "sha256-CwIfRmwJREz24Qj6J2PKQp+ix+/ZXo1oamcHc1fPUoc="; + vendorHash = "sha256-uy8/bkgjDXnt544S70IOwX9I8U0lMLAkbiBDYXyJBcY="; nativeInstallCheckInputs = [ versionCheckHook From 5e612de4127f4862a45c29709f4bc2ebc1f8062e Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:36:56 +0200 Subject: [PATCH 20/24] phpPackages.box: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/development/php-packages/box/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/php-packages/box/default.nix b/pkgs/development/php-packages/box/default.nix index 2c998d510279..8d43a6d27127 100644 --- a/pkgs/development/php-packages/box/default.nix +++ b/pkgs/development/php-packages/box/default.nix @@ -16,7 +16,7 @@ php82.buildComposerProject2 (finalAttrs: { hash = "sha256-giJAcH2R9hAlUTbwRi7rbmUP+WV8Nfb9XmoHHs4RcbI="; }; - vendorHash = "sha256-7oZtuQ7PhB7q9vNO2TLI46kg2q9BgdLjGUduGXAHc0E="; + vendorHash = "sha256-A/hAw0J4Q3kun6soxI6h7kpyGef9q0EFg8HAQHHZUro="; doInstallCheck = true; nativeInstallCheckInputs = [ versionCheckHook ]; From c75ff9ff2e6026e56fc9b52f08658bb04d700f4a Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:37:12 +0200 Subject: [PATCH 21/24] phpPackages.phpmd: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/development/php-packages/phpmd/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/php-packages/phpmd/default.nix b/pkgs/development/php-packages/phpmd/default.nix index c254fe239871..06533e74a241 100644 --- a/pkgs/development/php-packages/phpmd/default.nix +++ b/pkgs/development/php-packages/phpmd/default.nix @@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: { # Missing `composer.lock` from the repository. # Issue open at https://github.com/phpmd/phpmd/issues/1056 composerLock = ./composer.lock; - vendorHash = "sha256-AahAs3Gq1OQ+CW3+rU8NnWcR3hKzVNq7s3llsO4mQ38="; + vendorHash = "sha256-tiL8PL6Muc/i4Il1rCeEKenCmIEVn3rHFZInbUGQW9o="; nativeInstallCheckInputs = [ versionCheckHook ]; versionCheckProgramArg = "--version"; From a61d468940fe58b7d4238731e46e0af00e84b26a Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:37:27 +0200 Subject: [PATCH 22/24] phpPackages.phing: fix composer hash Confirmed with diffoscope that only the composer-generated code did change. See #451395 --- pkgs/development/php-packages/phing/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/php-packages/phing/default.nix b/pkgs/development/php-packages/phing/default.nix index 6edfcbe0426a..7d76d08f7753 100644 --- a/pkgs/development/php-packages/phing/default.nix +++ b/pkgs/development/php-packages/phing/default.nix @@ -17,7 +17,7 @@ hash = "sha256-gY6ocmkd7eJIMaBrewfxYL7gTr+1qNHTkuAp+w9ApUU="; }; - vendorHash = "sha256-3frpoQzHtJA2/jJpZT+yIRatEwiY6LIUGzEZBa8hXbM="; + vendorHash = "sha256-zrHOw7Uyq8H7AyxrfCo5VthX1EeoSB44ynrRt38u3Sk="; nativeInstallCheckInputs = [ versionCheckHook From c965f5142f27d400307bf09209847d3be3ff954c Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 15:40:32 +0200 Subject: [PATCH 23/24] doc: add warning about composer bug --- doc/languages-frameworks/php.section.md | 6 ++++++ pkgs/development/php-packages/composer/default.nix | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/doc/languages-frameworks/php.section.md b/doc/languages-frameworks/php.section.md index 9f221679ce22..a61c27db84a3 100644 --- a/doc/languages-frameworks/php.section.md +++ b/doc/languages-frameworks/php.section.md @@ -214,6 +214,12 @@ code, while others choose not to. In Nix, there are multiple approaches to building a Composer-based project. +::: {.warning} +`buildComposerProject2` has a [known bug](https://github.com/NixOS/nixpkgs/issues/451395) +where the `vendorHash` changes every a Composer release happens that changes the +`autoload.php` or vendored composer code. +::: + One such method is the `php.buildComposerProject2` helper function, which serves as a wrapper around `mkDerivation`. diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix index e44f8f9777a6..c36e401e3b15 100644 --- a/pkgs/development/php-packages/composer/default.nix +++ b/pkgs/development/php-packages/composer/default.nix @@ -14,6 +14,13 @@ versionCheckHook, }: +/* + XXX IMPORTANT + + Make sure to check if the `vendorHash` of `buildComposerProject2` changes when updating! + See https://github.com/NixOS/nixpkgs/issues/451395 +*/ + stdenvNoCC.mkDerivation (finalAttrs: { pname = "composer"; version = "2.8.12"; From 48bc243a6338381a24e0317b8ee3252cfcba86f2 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 17 Oct 2025 16:14:48 +0200 Subject: [PATCH 24/24] doc/php: fix typo Co-authored-by: Blui42 <61911304+Blui42@users.noreply.github.com> --- doc/languages-frameworks/php.section.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/languages-frameworks/php.section.md b/doc/languages-frameworks/php.section.md index a61c27db84a3..988fa659f0aa 100644 --- a/doc/languages-frameworks/php.section.md +++ b/doc/languages-frameworks/php.section.md @@ -216,7 +216,7 @@ In Nix, there are multiple approaches to building a Composer-based project. ::: {.warning} `buildComposerProject2` has a [known bug](https://github.com/NixOS/nixpkgs/issues/451395) -where the `vendorHash` changes every a Composer release happens that changes the +where the `vendorHash` changes every time a Composer release happens that changes the `autoload.php` or vendored composer code. :::