Warn when SYMFONY_REQUIRE is set to an exact version constraint

[GromNaN]

Problem

Setting SYMFONY_REQUIRE=7.4 (or any exact version like 7, 7.4.1) is treated by Composer as the constraint = 7.4.0.0 — it will only match that single specific version.

This causes two classes of silent failures:

• Security advisories block exact versions. When a package version is flagged by a security advisory, Composer refuses to install it. With an exact constraint, there is no fallback version, so the installation fails with no clear explanation. See policy.advisories.block blocks non-affected versions when symfony/flex truncates the pool (SYMFONY_REQUIRE) composer/composer#12936.

• Not all packages exist at every bugfix version. Symfony skips publishing packages that have no changes in a given bugfix release. For example, symfony/console 7.4.3 may not exist if there were no changes to that component in that release. An exact constraint would then fail to resolve.

The intended constraints are 7.4.* (allows any 7.4.x) or ^7.4 (allows >=7.4.0 <8.0.0).

Solution

Use Composer\Semver\VersionParser to parse the constraint and detect when it resolves to a single == constraint (i.e. an exact version). A warning is then emitted suggesting the correct form:

[warning] SYMFONY_REQUIRE="7.4" is an exact version constraint. Did you mean "7.4.*" or "^7.4"?

This applies whether the value comes from the SYMFONY_REQUIRE environment variable or from extra.symfony.require in composer.json.