[Composer] Target lowest version for any distributed package type, only 'project' is an application

[TomasVotruba]

What

Two related changes to how composer-package versions drive version-bound rules.

1. Lowest declared version for distributed packages

InstalledPackageResolver treated only "type": "library" as a distributed package. Now any non-project type (library, symfony-bundle, rector-extension, ...) targets the lowest declared version, while a missing type or an explicit "project" stays an application on the installed version.

-        return ($projectComposerJson['type'] ?? null) === 'library';
+        $type = $projectComposerJson['type'] ?? null;
+
+        return is_string($type) && $type !== 'project';

2. Honor a test-provided composer.json for composer-bound rules

RectorConfig::ruleWithConfigurationComposerVersionBound() resolved the version through a private new InstalledPackageResolver() reading the project root, ignoring the resolver a test configures via AbstractRectorTestCase::provideComposerJsonFilePath(). It now resolves through the container-bound singleton, so a test-specific composer.json drives the version:

-        $this->installedPackageResolver ??= new InstalledPackageResolver();
-        return $this->installedPackageResolver->resolvePackageVersion($packageName);
+        if (! $this->bound(InstalledPackageResolver::class)) {
+            $this->singleton(InstalledPackageResolver::class);
+        }
+        return $this->make(InstalledPackageResolver::class)->resolvePackageVersion($packageName);

Without this, an extension package (e.g. rector-doctrine, "type": "rector-extension") resolved its version-bound rules from its own root composer.json — so change #1 dropped it to the lowest declared floor and deactivated newer-version rules in the extension's own test suite. With this, rector-doctrine's tests/ComposerBased/composer.json (rectorphp/rector-doctrine#513) drives the version deterministically; its root composer.json and fixtures stay untouched.

Tests

• InstalledPackageResolverTest: library test is a data provider over library + symfony-bundle; new project_composer_json fixture proves an explicit "project" keeps the installed version.
• Verified against rector-doctrine main: ComposerBasedTest 3/3 green, fixtures unchanged.

[samsonasik]

I think additional requirement check is needed, when the package has php version range, eg: has

"php": "^8.1 || ^8.2"

Then should follow lowest.

That will usually verify that multiple major version of requirment test eg: phpunit 10 or 11 n CI is needed.

[TomasVotruba]

This is already handled by PHP version and the min php version interface. Different area.