Bad tag for v4.0.0-beta1 causing composer update to fail

[matthandus]

Describe the bug

This project has two tags stamped as beta1. One of the tags has improper syntax and should be deleted. Also, it looks like the bad tag was set as the actual release. See screenshot of tags for this project.

Good: 4.0.0-beta1
Bad: 4.0.0beta1

To reproduce

Steps to reproduce the behavior:

1. View tags page in github for this project.
2. Confirm dupe tags.
3. Delete tag for 4.0.0beta and make new release for 4.0.0-beta1.

Expected behavior

Expect releases and tags to conform to syntax standards for composer and not cause errors.

Additional context

Causes the project to not be indexed properly, which causes composer to fail when checking dependency tree.

Please confirm

• I have searched the issue list and am not opening a duplicate issue.
• I have read the Contribution Guidelines and this is not a support question.
• I confirm that this bug is a bug in PHP_CodeSniffer and not in one of the external standards.
• I have verified the issue still exists in the master branch of PHP_CodeSniffer.

[jrfnl]

@matthandus Thanks for opening this issue.

There are a couple of things at play here:

1. Historically, this project did not use a dash in alpha/beta/RC tags - see the tags around the 3.0.0 release.
2. IIRC, Composer actually supports both releases with a dash and without for alpha/beta/RC.
3. PHP releases itself do not use the dash and the version_compare() function in PHP itself does not necessarily expect a dash.

With the above in mind, I tagged the 4.0.0beta1 release without a dash.

However, semver expects a dash and PHIVE was having trouble with a release called 4.0.0beta1, expecting a semver compliant tag.

With that in mind, I added the 4.0.0-beta1 tag at the same commit in hopes of resolving issues people may experience with this.

Creating a new release is not on the table as it would break existing links/references (beta1 was tagged early May), removing either tag is also not an option as people may be referring to them.

Having said all this, since then the 4.0.0-RC1 release was tagged, which supersedes the 4.0.0-beta1 tag, and anyone testing should now be using 4.0.0-RC1, which does not have the aforementioned issue.

All in all, I don't see anything actionable here and would like to suggest closing this issue.

[heddn]

It seems that various packagists have picked this up. I get the following error from composer when attempting to update to a newer version of Drupal:

$ composer u -W

In ArrayLoader.php line 112:
                                                                                                                                                       
  Unknown package has no name defined ({"version":"4.0.0beta1","source":{"url":"https:\/\/github.com\/PHPCSStandards\/PHP_CodeSniffer.git","type":"gi  
  t","reference":"b37066133dc2d2d0291187f3120035ef33032caf"},"dist":{"type":"zip","url":"https:\/\/artifacts.example.com\/artifactory\/api\/composer\/c  
  omposer\/vcs-dists\/zip\/PHPCSStandards\/PHP_CodeSniffer\/b37066133dc2d2d0291187f3120035ef33032caf","reference":"b37066133dc2d2d0291187f31200  
  35ef33032caf","shasum":""},"time":"2025-05-11T04:14:19+00:00","distUrl":"https:\/\/artifacts.example.com\/artifactory\/api\/composer\/composer-packag  
  ist-remote\/vcs-dists\/zip\/PHPCSStandards\/PHP_CodeSniffer\/b37066133dc2d2d0291187f3120035ef33032caf","version_normalized":"4.0.0.0-beta1","notifi  
  cation-url":null}).                                                                                                                                  

[jrfnl]

I still don't know what I can do to fix this. Re-releasing the beta is not an option.
All I can think of is to delete the 4.0.0beta1 tag from Packagist and hope it remains deleted, though that may also break things for people 🤷🏻‍♀️ .

If anyone has bright suggestions, feel free to point them out.

[fredden]

@heddn please can you provide some steps to reproduce this behaviour? (A minimal composer.json file and maybe a lock file as the example command is an update, if that's relevant.) Understanding what's going on within Composer / artifactory may help with resolving the problem you're facing.

[heddn]

I wish I could share an output, but its a private client packagist and they are a bit sensitive to those details getting out to the public.

Once thing I was told by an associate as a work around was to "exclude" this package. Something like:

"repositories": [
  {
    "type": "composer",
    "url": "https://artifacts.example.com/artifactory/api/composer",
    "exclude": ["squizlabs/php_codesniffer"]
  }
],