Report a missing GPM dependency instead of fatalling

GPM::findPackage() returns false when nothing in the index matches, and
InstallCommand::installDependencies() passed that straight into
processPackage(?Package $package) — a TypeError, so `bin/gpm install` died on
an uncatchable fatal. processPackage() already had the "Package not found on
the GPM!" branch for exactly this case; the type declaration just meant it
could never run.

Any plugin still declaring the Grav 1.7 `admin` plugin as a dependency
triggered it on Grav 2, where no `admin` package exists in the index.

Two siblings read a property straight off that same false: the uninstall
dependency walk before packageExists(), and
calculateMergedDependenciesOfPackage().

Reported by @onetrev [getgrav/grav-premium-issues#618]

Author: rhukster

CHANGELOG.md

@@ -1,3 +1,15 @@
+# v2.0.24
+## 09/03/2026
+
+1. [](#bugfix)
+    * Installing a package whose dependency is not in the GPM index now says so and carries on, instead of stopping the command with a PHP fatal error. A plugin that still asks for the Grav 1.7 admin plugin was enough to trigger it [getgrav/grav-premium-issues#618](https://github.com/getgrav/grav-premium-issues/issues/618)
+
+# v2.0.24
+## 09/03/2026
+
+1. [](#bugfix)
+    * A JSON request whose body is a bare scalar (`"text"`, `12345`, `true`) sent with `Content-Type: application/json` no longer answers a 500 from the request pipeline before any route runs. It is treated as an empty body, so a plugin's webhook or API route gets to answer it, log it and refuse it itself. With `errors.display` on, the old failure also printed a stack trace with server paths to whoever sent it
+
 # v2.0.23
 ## 09/02/2026
 

system/defines.php

@@ -9,7 +9,7 @@
 
 // Some standard defines
 define("GRAV", true);
-define("GRAV_VERSION", "2.0.23");
+define("GRAV_VERSION", "2.0.24");
 define("GRAV_SCHEMA", "1.8.0_2026-06-09_0");
 define("GRAV_TESTING", false);
 

system/src/Grav/Common/GPM/GPM.php

@@ -1225,7 +1225,10 @@ private function calculateMergedDependenciesOfPackage($packageName, $dependencie
     {
         $packageData = $this->findPackage($packageName);
 
-        if (empty($packageData->dependencies)) {
+        // findPackage() returns false when the index has no such package, and
+        // reading a property off that is a PHP 8 warning before empty() ever
+        // sees it.
+        if (!$packageData || empty($packageData->dependencies)) {
             return $dependencies;
         }
 

system/src/Grav/Common/Processors/RequestProcessor.php

@@ -39,7 +39,13 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
         $header = $request->getHeaderLine('Content-Type');
         $type = trim(strstr($header, ';', true) ?: $header);
         if ($type === 'application/json') {
-            $request = $request->withParsedBody(json_decode($request->getBody()->getContents(), true));
+            // withParsedBody() accepts an array, an object or null. A JSON scalar
+            // ("a string", 12345, true) decodes to none of those, and handing it
+            // over threw an InvalidArgumentException that answered the request
+            // with a 500 before any route ran. A scalar is not a body a handler
+            // can read, so it is treated as no body at all.
+            $decoded = json_decode($request->getBody()->getContents(), true);
+            $request = $request->withParsedBody(is_array($decoded) ? $decoded : null);
         }
 
         $uri = $request->getUri();

system/src/Grav/Console/Gpm/InstallCommand.php

@@ -334,7 +334,14 @@ public function installDependencies(array $dependencies, string $type, string $m
 
             if ($answer) {
                 foreach ($packages as $dependencyName => $dependencyVersion) {
-                    $package = $this->gpm->findPackage($dependencyName);
+                    // findPackage() returns false, not null, when nothing in the
+                    // index matches — and processPackage() is typed ?Package, so
+                    // passing that straight through was a TypeError rather than
+                    // the "Package not found on the GPM!" message it already
+                    // knows how to print. A plugin asking for a dependency that
+                    // does not exist on this Grav version (the 1.7 `admin`
+                    // plugin, say) must report it, not fatal.
+                    $package = $this->gpm->findPackage($dependencyName) ?: null;
                     $this->processPackage($package, $type === 'update');
                 }
                 $io->newLine();

system/src/Grav/Console/Gpm/UninstallCommand.php

@@ -204,6 +204,13 @@ private function uninstallPackage($slug, $package, $is_dependency = false): bool
 
                 $dependencyPackage = $this->gpm->findPackage($dependency);
 
+                // Same false-not-null return as the install path: a dependency
+                // missing from the index would otherwise reach packageExists()
+                // and have its `package_type` read off a bool.
+                if (!$dependencyPackage) {
+                    continue;
+                }
+
                 $dependency_exists = $this->packageExists($dependency, $dependencyPackage);
 
                 if ($dependency_exists == Installer::EXISTS) {