Laravel 10安装laravel/passport时Composer依赖冲突问题求助

问题重现 #

执行composer require laravel/passport时出现依赖解析错误，完整错误日志如下：

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - laravel/passport[v11.5.0, ..., v11.8.4] require league/oauth2-server ^8.2 -> satisfiable by league/oauth2-server[8.2.0, ..., 8.5.3].   
    - laravel/passport[v11.8.5, ..., v11.8.8] require lcobucci/jwt ^4.3|^5.0 -> satisfiable by lcobucci/jwt[4.3.0, 5.0.0].
    - league/oauth2-server[8.5.2, ..., 8.5.3] require lcobucci/jwt ^4.3 || ^5.0 -> satisfiable by lcobucci/jwt[4.3.0, 5.0.0].
    - laravel/passport[v0.1.0, ..., v0.2.4, v1.0.0, ..., v1.0.18, v2.0.0, ..., v2.0.11, v3.0.0, ..., v3.0.2, v4.0.0, ..., v4.0.3, v5.0.0, ..., v5.0.3, v6.0.0, ..., v6.0.7, v7.0.0, ..., v7.5.1] require guzzlehttp/guzzle ~6.0 -> found guzzlehttp/guzzle[6.0.0, ..., 6.5.8] but it conflicts with your root composer.json require (^7.2).
    - laravel/passport[v8.0.0, ..., v8.5.0, v9.0.0, ..., v9.3.2] require php ^7.2 -> your php version (8.2.0) does not satisfy that requirement.
    - laravel/passport v9.4.0 requires illuminate/auth ^6.18.31|^7.22.4 -> found illuminate/auth[v6.18.31, ..., v6.20.44, v7.22.4, ..., v7.30.6] but these were not loaded, likely because it conflicts with another require.
    - laravel/passport[v10.0.0, ..., v10.0.1] require php ^7.3 -> your php version (8.2.0) does not satisfy that requirement.
    - laravel/passport[v10.1.0, ..., v10.2.2] require illuminate/auth ^8.2 -> found illuminate/auth[v8.2.0, ..., v8.83.27] but these were not loaded, likely because it conflicts with another require.
    - laravel/passport[v10.3.0, ..., v10.3.2] require illuminate/auth ^8.2|^9.0 -> found illuminate/auth[v8.2.0, ..., v8.83.27, v9.0.0, ..., 
v9.52.10] but these were not loaded, likely because it conflicts with another require.
    - laravel/passport[v10.3.3, ..., v10.4.2] require illuminate/auth ^8.37|^9.0 -> found illuminate/auth[v8.37.0, ..., v8.83.27, v9.0.0, ..., v9.52.10] but these were not loaded, likely because it conflicts with another require.
    - laravel/passport[v11.0.0, ..., v11.4.0] require illuminate/auth ^9.0 -> found illuminate/auth[v9.0.0, ..., v9.52.10] but these were not loaded, likely because it conflicts with another require.
    - league/oauth2-server[8.2.0, ..., 8.5.1] require psr/http-message ^1.0.1 -> found psr/http-message[1.0.1, 1.1] but the package is fixed 
to 2.0 (lock file version) by a partial update and that version does not match. Make sure you list it as an argument for the update command. 
    - lcobucci/jwt[4.3.0, 5.0.0] require ext-sodium * -> it is missing from your system. Install or enable PHP's sodium extension.
    - Root composer.json requires laravel/passport * -> satisfiable by laravel/passport[v0.1.0, ..., v0.2.4, v1.0.0, ..., v1.0.18, v2.0.0, ..., v2.0.11, v3.0.0, v3.0.1, v3.0.2, v4.0.0, v4.0.1, v4.0.2, v4.0.3, v5.0.0, v5.0.1, v5.0.2, v5.0.3, v6.0.0, ..., v6.0.7, v7.0.0, ..., v7.5.1,

To enable extensions, verify that they are enabled in your .ini files:
    - C:\xampp3\php\php.ini
You can also run `php --ini` in a terminal to see which files are used by PHP in CLI mode.
Alternatively, you can run Composer with `--ignore-platform-req=ext-sodium` to temporarily ignore these required extensions.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.   
You can also try re-running composer require with an explicit version constraint, e.g. "composer require laravel/passport:*" to figure out if any version is installable, or "composer require laravel/passport:^2.1" if you know which you need.

Installation failed, reverting ./composer.json and ./composer.lock to their original content.

环境信息 #

• PHP版本：^8.1（实际运行版本8.2.0）
• Laravel版本：10.15.0
• 执行composer install --ignore-platform-reqs输出：

Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Nothing to install, update or remove
Generating optimized autoload files
> Illuminate\Foundation\ComposerScripts::postAutoloadDump
> @php artisan package:discover --ansi


  laravel/sail ....................................................................................................................... DONE  
  laravel/sanctum .................................................................................................................... DONE  
  laravel/tinker ..................................................................................................................... DONE  
  nesbot/carbon ...................................................................................................................... DONE  
  nunomaduro/collision ............................................................................................................... DONE  
  nunomaduro/termwind ................................................................................................................ DONE  
  spatie/laravel-ignition ............................................................................................................ DONE  

82 packages you are using are looking for funding.
Use the `composer fund` command to find out more!

• 项目composer.json内容：

{
"name": "laravel/laravel",
"type": "project",
"description": "The skeleton application for the Laravel framework.",
"keywords": ["laravel", "framework"],
"license": "MIT",
"require": {
    "php": "^8.1",
    "guzzlehttp/guzzle": "^7.2",
    "laravel/framework": "^10.10",
    "laravel/sanctum": "^3.2",
    "laravel/tinker": "^2.8"
},
"require-dev": {
    "fakerphp/faker": "^1.9.1",
    "laravel/pint": "^1.0",
    "laravel/sail": "^1.18",
    "mockery/mockery": "^1.4.4",
    "nunomaduro/collision": "^7.0",
    "phpunit/phpunit": "^10.1",
    "spatie/laravel-ignition": "^2.0"
},
"autoload": {
    "psr-4": {
        "App\\": "app/",
        "Database\\Factories\\": "database/factories/",
        "Database\\Seeders\\": "database/seeders/"
    }
},
"autoload-dev": {
    "psr-4": {
        "Tests\\": "tests/"
    }
},
"scripts": {
    "post-autoload-dump": [
        "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
        "@php artisan package:discover --ansi"
    ],
    "post-update-cmd": [
        "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
    ],
    "post-root-package-install": [
        "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
    ],
    "post-create-project-cmd": [
        "@php artisan key:generate --ansi"
    ]
},
"extra": {
    "laravel": {
        "dont-discover": []
    }
},
"config": {
    "optimize-autoloader": true,
    "preferred-install": "dist",
    "sort-packages": true,
    "allow-plugins": {
        "pestphp/pest-plugin": true,
        "php-http/discovery": true
    }
},
"minimum-stability": "stable",
"prefer-stable": true
}

错误分析 #

1. 依赖版本冲突：旧版Passport（v0.x到v7.x）依赖Guzzle 6.x，与项目要求的Guzzle ^7.2冲突；v8.x到v10.x部分版本依赖PHP 7.x或Laravel 8/9，与当前PHP 8.2、Laravel 10不兼容。
2. 扩展缺失：最新兼容的Passport v11.x依赖lcobucci/jwt，而该包需要PHP的sodium扩展，当前环境未启用。
3. 锁定包版本不兼容：psr/http-message被锁定在2.0版本，部分Passport依赖的league/oauth2-server需要1.x版本，无法自动更新。

解决步骤 #

1. 启用PHP Sodium扩展 #

• 找到PHP配置文件php.ini（路径：C:\xampp3\php\php.ini）
• 找到;extension=sodium这一行，去掉前面的分号，改为extension=sodium
• 重启XAMPP或PHP服务
• 执行php -m命令，确认输出中包含sodium，说明扩展已启用

2. 使用依赖更新参数安装Passport #

执行以下命令，允许Composer更新相关依赖包以解决版本冲突：

composer require laravel/passport -W

-W参数是--with-all-dependencies的简写，允许Composer对现有锁定包进行升级、降级或移除操作，确保依赖链兼容。

3. （可选）指定兼容版本安装 #

如果上述命令仍有问题，可以直接指定Laravel 10兼容的Passport版本：

composer require laravel/passport:^11.8 -W

4. 验证安装 #

安装完成后，执行Passport初始化命令验证是否正常：

php artisan passport:install

如果成功生成加密密钥和客户端ID/密钥，说明安装完成。

内容的提问来源于stack exchange，提问作者Guillermo GG