[fabeat]

The site installs the two libraries as path repositories and pins the exact version, so it names a released version twice: once in require and once in the path repository's versions map. Both move to 0.3.1, and the lock file with them.

The lock file carries more than the two versions, and it is worth saying what. Both libraries carry a patch of their own — phpoffice/phpword and phpoffice/phppresentation — and the lock file records the URL and the checksum of each, so the site applies them. That is not incidental: it is what puts the site's documents through the patched PHPWord, and it is why the site needs the pinned versions at all. composer-patches reads the patches of a dependency out of the lock file, so the patch reaches the site without the site naming it.

The transcript on the command-line page moves with it: an installed mdoffice takes the newest release in the ^0.3 series, so it answers v0.3.1 once the tags are cut.

The patch the lock file names moved with them. The PHPPresentation patch carries
four fixes now, and the third and fourth are the ones a review of the chart fix found:
the data points of a series that the area, the line, the radar and the scatter dropped,
and the fill of the series that a doughnut, a pie and a pie in three dimensions
dropped. The patch is a different file with a different checksum, and the lock file
records both — so the lock file moves too.

The site renders its examples with the code checked out beside it, so this is what puts the documents the site shows through the patched PHPWord.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud