更新Sonata Bundle时出现jms-serializer等Composer依赖冲突报错

出于安全合规要求更新项目内相关依赖Bundle，执行composer update操作时Sonata相关依赖出现多项异常，提问者依赖管理经验不足，无法独立定位解决问题，求助可行方案。

• 依赖丢失问题：SonataCore、sonataMedia、JMS-serializer三个Bundle出现丢失情况，相关bundles.php配置参考截图：
  
• SonataCore重装报错：执行composer require sonata-project/core-bundle命令重装SonataCore时返回如下错误：

  Problem 1 - Root composer.json requires sonata-project/core-bundle ^3.20 -> satisfiable by sonata-project/core-bundle[3.20.0]. - sonata-project/core-bundle 3.20.0 requires sonata-project/form-extensions ^0.1 -> found sonata-project/form-extensions[0.1.0, 0.1.1, 0.1.2] but the package is fixed to 1.16.1 (lock file version) by a partial update and that version does not match. Make sure you list it as an argument for the update command.
  

• SonataMedia重装报错：执行composer require sonata-project/media-bundle命令重装SonataMedia时返回如下错误：

  Problem 1 - sonata-project/media-bundle[4.1.0, ..., 4.1.5] require doctrine/persistence ^2.0 -> found doctrine/persistence[2.0.0, ..., 2.5.3] but the package is fixed to 1.3.8 (lock file version) by a partial update and that version does not match. Make sure you list it as an argument for the update command. - Root composer.json requires sonata-project/media-bundle ^4.1 -> satisfiable by sonata-project/media-bundle[4.1.0, ..., 4.1.5].
  

• JMS-Serializer相关报错：JMS-Serializer可正常安装，但安装完成后会触发jms_serializer.handler_registry相关错误，业务代码中未调用该服务，相关引用仅出现在缓存文件中。

{
    "type": "project",
    "license": "proprietary",
    "require": {
        "php": "^7.1.3",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "ext-json": "*",
        "composer/package-versions-deprecated": "1.11.99.5",
        "dekalee/mailjet-bundle": "^2.1",
        "doctrine/common": "^2",
        "doctrine/doctrine-bundle": "^2",
        "doctrine/doctrine-migrations-bundle": "^2",
        "doctrine/orm": "^2",
        "friendsofsymfony/rest-bundle": "^2.6",
        "friendsofsymfony/user-bundle": "~2.0",
        "guzzlehttp/guzzle": "^6.5",
        "hslavich/oneloginsaml-bundle": "^1.4",
        "jmose/command-scheduler-bundle": "^2.2",
        "jms/serializer-bundle": "^4.0",
        "michaeldegroot/doctrine-encrypt-bundle": "^4.0",
        "nelmio/api-doc-bundle": "^3.5",
        "paragonie/halite": "^4",
        "phpoffice/phpspreadsheet": "^1.10",
        "sonata-project/admin-bundle": "^3.56",
        "sonata-project/doctrine-orm-admin-bundle": "^3.12",
        "sonata-project/formatter-bundle": "^4.1",
        "sonata-project/intl-bundle": "^2.7",
        "sonata-project/user-bundle": "^4.5",
        "symfony/console": "4.4.*",
        "symfony/dotenv": "4.4.*",
        "symfony/flex": "^1.3.1",
        "symfony/framework-bundle": "4.4.*",
        "symfony/mailer": "4.4.*",
        "symfony/mime": "4.4.*",
        "symfony/monolog-bundle": "^3.5",
        "symfony/serializer": "4.4.*",
        "symfony/swiftmailer-bundle": "^3.4",
        "symfony/translation": "4.4.*",
        "symfony/twig-bundle": "4.4.*",
        "symfony/yaml": "4.4.*",
        "twig/extra-bundle": "^2.12|^3.0",
        "twig/twig": "^2.12|^3.0",
        "vich/uploader-bundle": "^1.12"
    },
    "require-dev": {
        "sonata-project/easy-extends-bundle": "^2.5",
        "symfony/debug-bundle": "4.4.*",
        "symfony/maker-bundle": "^1.14",
        "symfony/stopwatch": "4.4.*",
        "symfony/web-profiler-bundle": "4.4.*"
    },
    "config": {
        "preferred-install": {
            "*": "dist"
        },
        "sort-packages": true,
        "allow-plugins": {
            "ocramius/package-versions": true,
            "symfony/flex": true
        }
    },
    "autoload": {
        "psr-4": {
            "App\\": "src/"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "App\\Tests\\": "tests/"
        }
    },
    "replace": {
        "paragonie/random_compat": "2.*",
        "symfony/polyfill-ctype": "*",
        "symfony/polyfill-iconv": "*",
        "symfony/polyfill-php71": "*",
        "symfony/polyfill-php70": "*",
        "symfony/polyfill-php56": "*"
    },
    "scripts": {
        "auto-scripts": {
            "cache:clear": "symfony-cmd",
            "assets:install %PUBLIC_DIR%": "symfony-cmd"
        },
        "post-install-cmd": [
            "@auto-scripts"
        ],
        "post-update-cmd": [
            "@auto-scripts"
        ]
    },
    "conflict": {
        "symfony/symfony": "*"
    },
    "extra": {
        "symfony": {
            "allow-contrib": "true",
            "require": "4.4.*"
        }
    }
}

所有报错核心原因是版本约束不兼容：当前项目使用Symfony 4.4、Sonata Admin 3.x生态，尝试安装的Sonata Media 4.x、JMS Serializer 4.x均为跨大版本组件，依赖的底层包版本和现有锁文件、约束冲突，单独执行单包更新会进一步导致锁文件版本错位。按以下步骤操作即可修复：

• 修正composer.json内的版本约束，和现有项目生态对齐
  1. 将jms/serializer-bundle的版本约束从^4.0改为^3.0，4.x版本和Sonata 3.x系列存在服务定义兼容问题，是触发jms_serializer.handler_registry缓存报错的直接原因
  2. 添加Sonata Media依赖时不要使用^4.1约束，改为^3.35，4.x版本要求Doctrine Persistence 2.0+，和现有doctrine/common ^2约束完全不兼容
  3. SonataCore依赖的sonata-project/form-extensions ^0.1版本冲突问题，会在上述两个依赖版本修正后自动解决，无需单独调整
• 清理旧依赖文件和缓存，避免锁文件残留干扰
  在项目根目录执行命令：

  rm -rf vendor composer.lock var/cache/*
  

• 全量重新安装依赖，不要单独执行composer require做单包更新

  composer install
  

• 依赖安装完成后，将缺失的三个Bundle注册到config/bundles.php文件中，添加以下配置项：

  Sonata\CoreBundle\SonataCoreBundle::class => ['all' => true],
  Sonata\MediaBundle\SonataMediaBundle::class => ['all' => true],
  JMS\SerializerBundle\JMSSerializerBundle::class => ['all' => true],
  

• 最后清理项目缓存，验证服务正常运行

  php bin/console cache:clear
  

补充说明：如果后续需要升级Sonata组件到4.x版本，必须同步升级PHP、Symfony、Doctrine到对应兼容版本，当前PHP 7.1、Symfony 4.4的运行环境无法兼容Sonata 4.x系列组件。

内容的提问来源于stack exchange，提问作者Jack Fair