Restricting packages to ~3.4.0 does not work any more

[emodric]

Hi!

Sometime in the last month, restricting packages to ~3.4.0 stopped working.

We use those in our CI as a handy way to test our package on different Symfony versions, making sure that symfony/* packages don't mix between major/minor versions.

# Install Flex as a global dependency to enable usage of extra.symfony.require
# while keeping Flex recipes from applying
- run: composer global config --no-plugins allow-plugins.symfony/flex true
- run: composer global require --no-scripts symfony/flex
- run: composer config extra.symfony.require ${{ matrix.symfony }} # matrix.symfony here is e.g. `~3.4.0`

You can see the difference in two of our CI runs.

First one is from one month ago: https://github.com/netgen-layouts/content-browser/actions/runs/4194466779/jobs/7272671922

Run composer update --prefer-dist --prefer-lowest --prefer-stable
Loading composer repositories with package information
Restricting packages listed in "symfony/symfony" to "~3.4.0"
Updating dependencies

Second one, which now fails because it installs some symfony/* packages even from 2.x: https://github.com/netgen-layouts/content-browser/actions/runs/4425163495/jobs/7759875499

Run composer update --prefer-dist --prefer-lowest --prefer-stable
Loading composer repositories with package information
Updating dependencies

As I see no relevant changes in latest versions of Flex, I presume this has to do something with Flex backend server and that something changed there.

Can this be looked into?

Thanks!

[nicolas-grekas]

Hi Edi, closing in favor of symfony/recipes#1181