chore: pin host-uk/core dependency to stable version #27

New issue

Open

opened 2026-02-20 16:39:46 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-20 16:39:46 +00:00

Member

Problem

composer.json requires "host-uk/core": "dev-main" - a mutable dev branch reference:

"require": {
    "php": "^8.2",
    "host-uk/core": "dev-main"
}

Impact

Builds are not reproducible: different installs may pull different code
dev-main can introduce breaking changes at any time
Packagist/Composer cannot guarantee compatibility with semantic versioning

Acceptance Criteria

Pin to a tagged release (e.g. ^1.0) once host-uk/core has stable releases
In the interim, use dev-main#<commit-hash> to pin to a specific commit
Update minimum-stability if needed

Discovered during automated scan (issue #3)

## Problem `composer.json` requires `"host-uk/core": "dev-main"` - a mutable dev branch reference: ```json "require": { "php": "^8.2", "host-uk/core": "dev-main" } ``` ## Impact - Builds are not reproducible: different installs may pull different code - `dev-main` can introduce breaking changes at any time - Packagist/Composer cannot guarantee compatibility with semantic versioning ## Acceptance Criteria - Pin to a tagged release (e.g. `^1.0`) once `host-uk/core` has stable releases - In the interim, use `dev-main#<commit-hash>` to pin to a specific commit - Update `minimum-stability` if needed _Discovered during automated scan (issue #3)_