Drop support for Composer 2.2, require Composer >=2.5.5

Clarifying Kunal’s excellent addition 😊

relating 🐛 Rely on TUF-protected resources to determine which updates are available Postponed: needs info this might require use to use the composer audit command which also means we would have to drop Composer 2.2.x sooner

👍

I think that's totally reasonable.

As discussed with @tedbow, @phenaproxima and @TravisCarden just now.

Wim Leers → credited phenaproxima → .

Wim Leers → credited TravisCarden → .

DrupalCI has Composer 2.5.4 installed. Let's work around that.

The last submitted patch, 6: 3350568.patch, failed testing. View results →

ComposerInspectorTest::testVersionCheck() needs to be updated to match.

The last submitted patch, 10: 3350568-10.patch, failed testing. View results →

Seems reasonable to require this now.

Two things:

- how clear is the error message if your composer version is out of date?
- we should open a drupalci environment issue to update so we can remove the workaround.

- how clear is the error message if your composer version is out of date?

Very. You'll get an error message like this:

The detected Composer version, 2.5.4, does not satisfy ~2.5.5 || ^2.6.

We can also remove \Drupal\package_manager\ComposerInspector::toBoolean() and its uses.

Good point!

The detected Composer version, 2.5.4, does not satisfy ~2.5.5 || ^2.6.

I'm not sure that's very clear for someone unfamiliar with composer seeing this in the Drupal admin UI. It could do with a link to docs or something - can be in a follow-up though.

We can't quite get rid of it actually, unless we want to hardcode 'true' and 'false' handling in multiple places, which seems worse and more brittle?

I did remove all the <2.5.5 compatibility layers though. Which includes the work-around introduced in 🐛 Random failure: "PHP temp directory (/tmp) does not exist or is not writable to Composer." Fixed ! 🥳

The last submitted patch, 19: 3350568-18.patch, failed testing. View results →

1) Drupal\Tests\automatic_updates\Build\CoreUpdateTest::testApi
Failed asserting that 'Error: Interface "Psr\Http\Message\UriInterface" not found in include() (line 17 of /tmp/build_workspace_e1dc4f9c9db3e326a986c427d8d30cd1a0xXzJ/project/vendor/guzzlehttp/psr7/src/Uri.php).\n
' contains "Username:".

This is an unrelated failure. It must be caused by 📌 Remove psr/http-message from drupal/core-recommended Fixed which was committed earlier today to Drupal 10.1.x. Investigating.

Confirmed: 📌 Since #3361983 was committed to Drupal core, psr/http-message needed to be explicitly required for build tests Needs work . That's now a blocker.

Re-testing now that the blocker is in.

The last submitted patch, 19: 3350568-18.patch, failed testing. View results →

New failures now despite the blocker being in because Composer 2.5.6 was released a few hours ago: https://github.com/composer/composer/releases/tag/2.5.6

1) Drupal\Tests\automatic_updates\Build\CoreUpdateTest::testApi
Failed asserting that two strings are identical.
--- Expected
+++ Actual
@@ @@
-''
+'
+Unable to collect the paths to exclude. realpath(): Argument #1 ($path) must be of type string, null given'

👆 This matches this in the release notes:

- BC Warning: Installers and InstallationManager::getInstallPath will now return null instead of an empty string for metapackages' paths. This may have adverse effects on plugin code using this expecting always a string but it is unlikely (#11455)
- Fixed metapackages showing their install path as the root package's path instead of empty (#11455)

Let's find out if sticking to 2.5.5 fixes it.

The last submitted patch, 26: 3350568-26.patch, failed testing. View results →

Well, well, well …

1) Drupal\Tests\package_manager\Kernel\PhpTufValidatorTest::testPluginNotInstalledInProjectRoot
PhpTuf\ComposerStager\Domain\Exception\RuntimeException: The process "'/usr/local/bin/composer' 'update' '--lock' '--working-dir=/tmp/package_manager_testing_roottest30603349/active'" exceeded the timeout of 120 seconds.

🤔

Does this perhaps not work correctly in Composer 2.5.5? Re-testing…

Re-test on PHP 8.1, MySQL 5.7 and Drupal 10.1 passed. So the failure on PHP 8.1, MySQL 8 and Drupal 10.1 must have been a random failure. Re-testing that too.

Just needs a follow-up.

1. +++ b/package_manager/src/ComposerInspector.php
   @@ -498,8 +490,8 @@ class ComposerInspector implements LoggerAwareInterface {
      public static function toBoolean(string $value): bool {
        return match ($value) {
   -      '1', 'true' => TRUE,
   -      '0', 'false' => FALSE,
   +      'true' => TRUE,
   +      'false' => FALSE,
        };
   

   I swear, we don't need this function anymore. We could just use `json_decode()`.

   I won't block commit on this, but could we please have a follow-up to remove toBoolean()?

2. +++ b/package_manager/src/ProcessFactory.php
   @@ -69,24 +69,6 @@ final class ProcessFactory implements ProcessFactoryInterface {
   -      // Work around Composer not being designed to be run massively in parallel
   -      // which it may in the context of Package Manager, at least for tests. It
   -      // is trivial to work around though: create a unique temporary directory
   -      // per process.
   -      // @see https://www.drupal.org/i/3338789#comment-14961390
   -      // @see https://github.com/composer/composer/commit/28e9193e9ebde743c19f334a7294830fc6429d06
   -      // @see https://github.com/composer/composer/commit/43eb471ec293822d377b618a4a14d8d3651f5d13
   -      // @todo Remove this once Composer 2.5.5 is required in https://www.drupal.org/i/3350568 (2.5.5 is the first release to contain the upstream fix: https://github.com/composer/composer/releases/tag/2.5.5)
   -      static $race_condition_proof_tmpdir;
   -      if (!isset($race_condition_proof_tmpdir)) {
   -        $race_condition_proof_tmpdir = sys_get_temp_dir() . '/' . getmypid();
   -        // The same PHP process may run multiple tests: create the directory
   -        // only once.
   -        if (!is_dir($race_condition_proof_tmpdir)) {
   -          mkdir($race_condition_proof_tmpdir);
   -        }
   -      }
   -      $env['TMPDIR'] = $race_condition_proof_tmpdir;
   

   🎉

Oh, and one other thing -- didn't Composer ship the minimum-stability default value fix in 2.5.5? In which case, could we remove that hack from getConfig()?

1. #31.1: ✅

2. Oh, and one other thing -- didn't Composer ship the minimum-stability default value fix in 2.5.5? In which case, could we remove that hack from getConfig()?

   Great catch! ✅

Thanks for fixing that! Committed and pushed to 3.0.x. No follow-up needed since Wim removed toBoolean() in the committed patch.

Lots of work-arounds gone! 🥳

18 insertions, 77 deletions

Automatically closed - issue fixed for 2 weeks with no activity.