Composer still attempts to perform impossible updates

[cs278]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

Composer

Package manager version

Composer 2.x

Language version

PHP 8.3

Manifest location and content before the Dependabot update

/composer.json:

{
    "require": {
        "symfony/var-exporter": "5.4.*"
    }
}

Generated with composer update --prefer-lowest --prefer-stable

/composer.lock:

{
    "_readme": [
        "This file locks the dependencies of your project to a known state",
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
    "content-hash": "8e4f34b9f2c827fd1736b81255f3746a",
    "packages": [
        {
            "name": "symfony/polyfill-php80",
            "version": "v1.16.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-php80.git",
                "reference": "c4bdcb0490a6c0e12c51e9d771fda5867e908fd2"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/c4bdcb0490a6c0e12c51e9d771fda5867e908fd2",
                "reference": "c4bdcb0490a6c0e12c51e9d771fda5867e908fd2",
                "shasum": ""
            },
            "require": {
                "php": ">=7.0.8"
            },
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "1.16-dev"
                }
            },
            "autoload": {
                "files": [
                    "bootstrap.php"
                ],
                "psr-4": {
                    "Symfony\\Polyfill\\Php80\\": ""
                },
                "classmap": [
                    "Resources/stubs"
                ]
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "Ion Bazan",
                    "email": "[email protected]"
                },
                {
                    "name": "Nicolas Grekas",
                    "email": "[email protected]"
                },
                {
                    "name": "Symfony Community",
                    "homepage": "https://symfony.com/contributors"
                }
            ],
            "description": "Symfony polyfill backporting some PHP 8.0+ features to lower PHP versions",
            "homepage": "https://symfony.com",
            "keywords": [
                "compatibility",
                "polyfill",
                "portable",
                "shim"
            ],
            "support": {
                "source": "https://github.com/symfony/polyfill-php80/tree/v1.16.0"
            },
            "funding": [
                {
                    "url": "https://symfony.com/sponsor",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/fabpot",
                    "type": "github"
                },
                {
                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
                    "type": "tidelift"
                }
            ],
            "time": "2020-05-08T16:50:20+00:00"
        },
        {
            "name": "symfony/var-exporter",
            "version": "v5.4.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/var-exporter.git",
                "reference": "d59446d6166b1643a8a3c30c2fa8e16e51cdbde7"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symfony/var-exporter/zipball/d59446d6166b1643a8a3c30c2fa8e16e51cdbde7",
                "reference": "d59446d6166b1643a8a3c30c2fa8e16e51cdbde7",
                "shasum": ""
            },
            "require": {
                "php": ">=7.2.5",
                "symfony/polyfill-php80": "^1.16"
            },
            "require-dev": {
                "symfony/var-dumper": "^4.4.9|^5.0.9|^6.0"
            },
            "type": "library",
            "autoload": {
                "psr-4": {
                    "Symfony\\Component\\VarExporter\\": ""
                },
                "exclude-from-classmap": [
                    "/Tests/"
                ]
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "Nicolas Grekas",
                    "email": "[email protected]"
                },
                {
                    "name": "Symfony Community",
                    "homepage": "https://symfony.com/contributors"
                }
            ],
            "description": "Allows exporting any serializable PHP data structure to plain PHP code",
            "homepage": "https://symfony.com",
            "keywords": [
                "clone",
                "construct",
                "export",
                "hydrate",
                "instantiate",
                "serialize"
            ],
            "support": {
                "source": "https://github.com/symfony/var-exporter/tree/v5.4.0"
            },
            "funding": [
                {
                    "url": "https://symfony.com/sponsor",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/fabpot",
                    "type": "github"
                },
                {
                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
                    "type": "tidelift"
                }
            ],
            "time": "2021-11-22T10:44:13+00:00"
        }
    ],
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "stable",
    "stability-flags": {},
    "prefer-stable": true,
    "prefer-lowest": true,
    "platform": {},
    "platform-dev": {},
    "plugin-api-version": "2.6.0"
}

dependabot.yml content

version: 2
updates:
  - package-ecosystem: composer
    directory: /
    versioning-strategy: lockfile-only
    schedule:
      interval: weekly
    commit-message:
      prefix: composer
      include: scope
    labels: []

Updated dependency

Dependabot reports no update possible

What you expected to see, versus what you actually saw

I expect dependabot to create a PR to raise the dependency to 5.4.45 which is the latest compatible version at time of writing, but it doesn't create a PR and the job output contains:

updater | 2025/01/14 15:44:16 ERROR <job_947919499> Your requirements could not be resolved to an installable set of packages.
  Problem 1
    - Root composer.json requires symfony/var-exporter 5.4.*, == 7.2.0, found symfony/var-exporter[v4.2.0-BETA1, ..., 4.4.x-dev, v5.0.0-BETA1, ..., 5.4.x-dev, v6.0.0-BETA1, ..., 6.4.x-dev, v7.0.0-BETA1, ..., 7.3.x-dev] but it does not match the constraint.

Native package manager behavior

$ composer update
Loading composer repositories with package information
Updating dependencies
Lock file operations: 0 installs, 2 updates, 0 removals
  - Upgrading symfony/polyfill-php80 (v1.16.0 => v1.31.0)
  - Upgrading symfony/var-exporter (v5.4.0 => v5.4.45)

Images of the diff or a link to the PR, issue, or logs

This seems similar to the issue that I previously reported #10033 which was fixed. It seems to me Dependabot is still trying to update packages to the very latest version rather than the latest version allowed by my constraints.

Smallest manifest that reproduces the issue

No response