How to limit a package's dependency to a certain PHP version in Composer?

Question

Our production server is PHP 5.5.24. A package I need (vlucas/dotenv) requires in its composer.json:

"symfony/polyfill-ctype": "^1.17"

Unfortunately version 1.20 of that symfony package requires 7.1, which causes Composer's platform check to fail. I cannot ignore the error/platform check because it results in a syntax error on PHP 5.5.

It seems that this does not work for sub-dependencies, just the package itself:

"config": {
    "platform": {
        "php": "5.5.24"
    }
}

I've completely deleted the vendor folder and done a fresh install. Upgrading the server is not an option.

Answer 1

You can just require an explicit version of a package without any additional constraints, and that will version-lock other dependencies.

Either manually add "symfony/polyfill-ctype": "1.17" to your composer.json file, or use composer require symfony/polyfill-ctype:1.17 from the command line.

I will warn you that this might cause you headaches in the future when you upgrade, so make sure that you document it somewhere. Specifically, you or someone else in the future will look at the code and say "we aren't even using that", and then remove it.