PHP应用集成Auth0时Composer依赖安装失败求助

问题描述 #

1. 安装Guzzle相关依赖时的错误 #

执行命令 composer require guzzlehttp/guzzle guzzlehttp/psr7 http-interop/http-factory-guzzle 时出现依赖冲突：

Info from https://repo.packagist.org: #StandWithUkraine
Using version ^7.5 for guzzlehttp/guzzle
Using version ^2.4 for guzzlehttp/psr7
Using version ^1.2 for http-interop/http-factory-guzzle
./composer.json has been updated
Running composer update guzzlehttp/guzzle guzzlehttp/psr7 http-interop/http-factory-guzzle
Loading composer repositories with package information
Info from https://repo.packagist.org: #StandWithUkraine
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - google/apiclient is locked to version v2.8.2 and an update of this package was not requested.
    - google/apiclient v2.8.2 requires guzzlehttp/psr7 ^1.2 -> found guzzlehttp/psr7[1.2.0, ..., 1.9.0] but it conflicts with your root composer.json require (^2.4).
  Problem 2
    - Root composer.json requires guzzlehttp/guzzle ^7.5 -> satisfiable by guzzlehttp/guzzle[7.5.0].
    - guzzlehttp/guzzle 7.5.0 requires guzzlehttp/promises ^1.5 -> found guzzlehttp/promises[1.5.0, 1.5.1, 1.5.2] but the package is fixed to 1.4.0 (lock file version) by a partial update and that version does not match. Make sure you list it as an argument for the update command.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

Installation failed, reverting ./composer.json and ./composer.lock to their original content.

2. 安装Auth0 PHP SDK时的错误 #

执行命令 composer require auth0/auth0-php 时出现错误：

Info from https://repo.packagist.org: #StandWithUkraine
Using version ^8.3 for auth0/auth0-php
./composer.json has been updated
Running composer update auth0/auth0-php
Loading composer repositories with package information
Info from https://repo.packagist.org: #StandWithUkraine
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - auth0/auth0-php[8.3.0, ..., 8.3.1] require psr/http-factory-implementation ^1.0 -> could not be found in any version, but the following packages provide it:
      - guzzlehttp/psr7 PSR-7 message implementation that also provides common utility methods
      - nyholm/psr7 A fast PHP7 implementation of PSR-7
      - http-interop/http-factory-guzzle An HTTP Factory using Guzzle PSR7
      - laminas/laminas-diactoros PSR HTTP Message implementations
      - zendframework/zend-diactoros PSR HTTP Message implementations
      - slim/psr7 Strict PSR-7 implementation
      - typo3/cms-core TYPO3 CMS Core
      - tuupola/http-factory Lightweight autodiscovering PSR-17 HTTP factories
      - nimbly/capsule Capsule is a simple PSR-7 HTTP message and PSR-17 HTTP factory implementation.
      - httpsoft/http-message Strict and fast implementation of PSR-7 and PSR-17
      - yiisoft/psr-dummy-provider PSR Dummy Provider
      - mileschou/psr The support library for PSR
      - oro/platform Business Application Platform (BAP)
      - typo3/cms TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj an
      - php-extended/php-http-message-factory-psr17 An implementation of the psr-17 based on the php-http-message-psr7 library
      - windwalker/uri Windwalker Uri package
      - sunrise/http-factory HTTP factory for PHP 7.1+ based on PSR-17
      - http-interop/http-factory-diactoros An HTTP Factory using Zend Diactoros
      - bittyphp/http PSR-7 and PSR-17 HTTP implementation.
      - windwalker/http Windwalker Http package
      ... and 49 more.
      Consider requiring one of these to satisfy the psr/http-factory-implementation requirement.
    - auth0/auth0-php[8.3.2, ..., 8.3.8] require php ^8.0 -> your php version (7.4.30) does not satisfy that requirement.
    - Root composer.json requires auth0/auth0-php ^8.3 -> satisfiable by auth0/auth0-php[8.3.0, ..., 8.3.8].

Potential causes:
 - A typo in the package name
 - The package is not available in a stable-enough version according to your minimum-stability setting
   see <https://getcomposer.org/doc/04-schema.md#minimum-stability> for more details.
 - It's a private package and you forgot to add a custom repository to find it

Read <https://getcomposer.org/doc/articles/troubleshooting.md> for further common problems.

Installation failed, reverting ./composer.json and ./composer.lock to their original content.

可靠修复方案 #

步骤1：锁定兼容PHP 7.4的Auth0 SDK版本 #

当前PHP版本为7.4.30，Auth0 SDK 8.3.2及以上要求PHP 8.0+，因此必须指定安装8.3.1版本（该版本兼容PHP 7.4，仅需PSR-17工厂实现依赖）。

步骤2：一次性安装兼容的依赖组合 #

执行以下命令，同时安装Auth0 SDK和匹配现有环境的Guzzle依赖，避免分步安装引发的冲突：

composer require auth0/auth0-php:8.3.1 guzzlehttp/guzzle:^7.0 guzzlehttp/psr7:^1.9 http-interop/http-factory-guzzle:^1.2 --with-all-dependencies

参数说明：

• auth0/auth0-php:8.3.1：匹配PHP 7.4，满足PSR-17工厂依赖要求
• guzzlehttp/psr7:^1.9：与已安装的google/apiclient v2.8.2要求的^1.2完全兼容
• guzzlehttp/guzzle:^7.0：7.0-7.4版本兼容当前lock文件中的guzzlehttp/promises 1.4.0，无需升级promises
• --with-all-dependencies：允许Composer自动调整相关依赖版本，确保整体兼容性（生产环境使用前，请先在测试环境验证）

步骤3：验证安装结果 #

安装完成后，检查composer.lock文件，确认以下依赖版本无冲突：

• google/apiclient保持v2.8.2
• guzzlehttp/psr7为1.9.x版本
• guzzlehttp/guzzle为7.0.x-7.4.x版本
• auth0/auth0-php为8.3.1

备选方案（若上述命令仍有冲突） #

如果允许升级google/apiclient，可先升级到兼容guzzlehttp/psr7 ^2.0的版本（如v2.12.0及以上），再安装Auth0 SDK：

composer require google/apiclient:^2.12 auth0/auth0-php:8.3.1 guzzlehttp/guzzle:^7.5 http-interop/http-factory-guzzle:^1.2 --with-all-dependencies

注意：此方案会升级google/apiclient，需先在测试环境验证应用功能不受影响，再部署到生产环境。

内容的提问来源于stack exchange，提问作者code-is-life