Hi Matt / all,
I’m running into the mike-roetgers/dependency-graph Composer issue again during the automatic monthly Bootstrapper run.
The system is currently on the tagged release train:
cpcmd scope:get cp.update-policy
# all
cd /usr/local/apnscp
git describe --tags --always --dirty
# v3.2.48.7
The Bootstrapper fails during apnscp/install-vendor-library because v3.2.48.7 still references:
mike-roetgers/dependency-graph 0.4.0
46b6bf207d0655dee1fd5a8a97a7449300f285f3
Composer then tries:
https://api.github.com/repos/MikeRoetgers/dependency-graph/zipball/46b6bf207d0655dee1fd5a8a97a7449300f285f3
which now returns HTTP 404. Falling back to source also fails because the repository is no longer publicly accessible.
I found that the fix appears to exist on origin/master in this commit:
1025a7bf36937e6a685f9eb66cae259a583daceb
CHG: incorporate mike-roetgers/dependency-graph into core library after repos marked private
Commit date:
2026-02-17 09:07:06 -0500
However, that commit is not included in v3.2.48.7:
git merge-base --is-ancestor 1025a7bf36937e6a685f9eb66cae259a583daceb v3.2.48.7
# exit code 1
v3.2.48.7 was tagged later, on May 12, 2026, but seems to be on the 3.2.48.x hotfix line and does not contain the dependency-graph fix from origin/master.
At the moment, hosted sites are still online, so this is not urgent for me, but Bootstrapper cannot complete successfully.
What is the recommended path for tagged-release users?
Should we temporarily switch to:
cpcmd scope:set cp.update-policy edge
upcp
or edge-major, or would it be possible to backport this fix into a v3.2.48.8 tag so systems on all/major can update cleanly?
Thanks.