Patch sort order issues with Gitlab's Composer package registry

[xurizaemon]

This is a PSA, not an issue against this project. (Unless JSON specifies that sort order is undetermined?)

When applying patches from a dependency which is hosted on Gitlab's Composer package registry, patches supplied from the dependency (along with require and require-dev entries, and any other key-value JSON data) may be reordered unexpectedly.

This can cause patches to fail application if they are not applied in the order they were provided in the dependency's composer.json.

Gitlab's behaviour appears to be to sort patches by the length of the patch key, shortest first.

An external composer.patches.json is a reasonable workaround, although path considerations come into play if you're doing that from a required package.

See https://gitlab.com/gitlab-org/gitlab/-/issues/364606 for the issue against Gitlab.

[cweagans]

main no longer resolves patches from dependencies, so this shouldn't be an issue.

[xurizaemon]

Thanks for the update, and closing this!

I see that on main at present patching from dependencies is still documented as supported.

I'm guessing a README update for that will be on your radar as it looks like there's lots of activity atm.

[cweagans]

1.x (which is based on the 1.x branch) still supports that. I don't plan on changing that. 2.x (which will eventually be tagged on main won't support it. Documentation is definitely on my radar :)