Drop support for end-of-life versions of Composer [#3343889]

Problem/Motivation

Bump composer minimum version requirement.
\Drupal\Tests\package_manager\Kernel\ComposerPatchesValidatorTest::testErrorDuringPreApplyis failing on my local and passing for @wim.leers as he is having higher composer version i.e 2.5.2 and I am on 2.4.1
with error:
error message

Why I think this can be a reason behind the test failure:
In active directory we actually do the composer install and it creates the vendor directory and install.json and install.php which is not the case with stage directory so something has changed with the newer version of composer, which is doing the extra check so we need to do the require “composer-plugin-api” to meet that requirement in stage.

Steps to reproduce

below is a screen shot of things I tried: versions

I was on local version 2.4.1 and \Drupal\Tests\package_manager\Kernel\ComposerPatchesValidatorTest::testErrorDuringPreApply was failing for me I tried updating version to 2.4.2 and 2.4.3 and then finally to 2.4.4 which made the tests pass. So we will need minimum 2.4.4 composer version.
Other reason to support this is https://endoflife.date/composer which shows that support for 2.4.1-2.4..3 are ended also for 2.4.4 has ended so that should be decided if we want to change the minimum version requirement to 2.4.4 or 2.5.*

support for composer 2.2.21 is not ended yet but it's going to end in 10 months and we are going to support drupal 10.1.* after that. So we can bump the minimum version constraint to maybe 2.4.4 or 2.5.1

set composer version to 2.4.1 and try running the test it should be fail, with the following error message:

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Comment	File	Size	Author
#4	Screenshot 2023-02-23 at 4.25.02 PM.png	453.28 KB	yash.rode
	Screenshot 2023-02-23 at 11.34.39 AM.png	181.81 KB	yash.rode

Issue fork automatic_updates-3343889

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

3343889-local-failure-due changes, plain diff MR !726
Check out this branch for the first time

Check out existing branch, if you already have it locally

About issue forks

Comments

Comment #1

23 February 2023 at 06:08

yash.rode created an issue. See original summary.

Comment #2

23 February 2023 at 06:10

yash.rode opened merge request !726

Comment #3

wim leers

Ghent 🇧🇪🇪🇺

commented 23 February 2023 at 07:50

$ composer --version
Composer version 2.5.2 2023-02-04 14:33:22
$ php -v
PHP 8.1.13 (cli) (built: Dec  7 2022 23:32:13) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.1.13, Copyright (c) Zend Technologies
    with Zend OPcache v8.1.13, Copyright (c), by Zend Technologies

and

..........                                                        10 / 10 (100%)

Time: 00:20.813, Memory: 10.00 MB

OK (10 tests, 48 assertions)

⇒ 2.5.2 is fine.

Comment #4

yash.rode commented 23 February 2023 at 11:16

Assigned:	Unassigned	» yash.rode
Issue summary:	View changes

Status	File	Size
new	Screenshot 2023-02-23 at 4.25.02 PM.png	453.28 KB

Comment #5

wim leers

Ghent 🇧🇪🇪🇺

commented 23 February 2023 at 11:25

Issue tags:

+Needs title update

Other reason to support this is https://endoflife.date/composer

→ Can you please find the official source and link that instead?

Looking forward to reading your proposed resolution! 🤓 And that should help you specify a better title too 😊

Comment #6

yash.rode commented 23 February 2023 at 13:13

Title:

Local failure due to composer's newer versions in ComposerPatchesValidatorTest::testErrorDuringPreApply

» Change composer constraint to supported version for tests to pass.

Comment #7

yash.rode commented 23 February 2023 at 16:19

Assigned:	yash.rode	» tedbow
Status:	Active	» Needs review

Comment #8

tedbow

he/him

English

Ithaca, NY, USA

commented 24 February 2023 at 05:35

Issue tags:

+sprint, +core-mvp

I am sure we need to do this for the reason stated.

Change composer constraint to supported version for tests to pass.

We should support , supported versions of the composer but I don't think that is the only reason those tests are failing.

It looks like we were adding an invalid package. Maybe 1 composer version is more strict on the checks

I think #3344127: Run `composer validate` after FixtureManipulator commits its changes will help with this because I have found it turns up errors like this that we were missing.

Also yash when you create an issue unless it is something we definitely should not work on now please add the sprint tag as I am am almost always filtering by this, thanks

Comment #9

tedbow

he/him

English

Ithaca, NY, USA

commented 24 February 2023 at 05:40

Assigned:

tedbow

» Unassigned

the current fix in the MR probably belongs in #3344127: Run `composer validate` after FixtureManipulator commits its changes. My guess is it is need to fix a failing test there

Comment #10

yash.rode commented 24 February 2023 at 09:03

Hi @wim.leers I am unable to find the official documentation for https://endoflife.date/composer. Removed test fix as it is going to be fixed in #3344127: Run `composer validate` after FixtureManipulator commits its changes. @tedbow wants to discuss with you, if we want to remove support for composer 2.2 version.

Comment #11

wim leers

Ghent 🇧🇪🇪🇺

commented 24 February 2023 at 09:49

Assigned:	Unassigned	» yash.rode
Status:	Needs review	» Needs work

Wow, that is indeed surprisingly hard to find!

Best sources I could find:
- https://blog.packagist.com/composer-2-2/
- https://github.com/endoflife-date/endoflife.date/commit/c8ee80ba5c7fbf33...

But … yeah … perhaps https://endoflife.date/composer is then the only choice to link to 😞

It makes sense that we want to discuss dropping 2.2 support, but dropping 2.3 support in favor of a newer version @tedbow is fine with. So marking Needs work for that.

Also, why are you proposing to require only 2.4.4 if that is already unsupported today? 🤔 Why not require 2.5?

Comment #12

yash.rode commented 24 February 2023 at 10:31

Assigned:	yash.rode	» wim leers
Status:	Needs work	» Needs review

I was thinking that the test will pass for all the versions above 2.4.4 but I am more lean towards setting the version to 2.5 and above, so made those changes in the MR (Ignored 2.2 version for the discussion).

Comment #13

wim leers

Ghent 🇧🇪🇪🇺

commented 24 February 2023 at 11:40

Title:	Change composer constraint to supported version for tests to pass.	» [Needs Discussion] Change composer constraint to supported version for tests to pass.
Assigned:	wim leers	» Unassigned

👍

This is now blocked on the discussion @tedbow and you mentioned!

Comment #14

wim leers

Ghent 🇧🇪🇪🇺

commented 24 February 2023 at 11:40

But in the meantime, could you already update the title to reflect the current direction? 🙏😊

Comment #15

yash.rode commented 24 February 2023 at 11:43

Title:

[Needs Discussion] Change composer constraint to supported version for tests to pass.

» [Needs Discussion] Change composer constraint to support supported versions.

Comment #16

wim leers

Ghent 🇧🇪🇪🇺

commented 24 February 2023 at 12:07

Title:	[Needs Discussion] Change composer constraint to support supported versions.	» [Needs Discussion] Change composer constraint to require supported versions
Issue tags:	-Needs title update

👍 Thanks!

Comment #17

27 February 2023 at 12:17

Wim Leers credited phenaproxima.

Comment #18

wim leers

Ghent 🇧🇪🇪🇺

commented 27 February 2023 at 12:17

Title:	[Needs Discussion] Change composer constraint to require supported versions	» Change composer constraint to require supported versions
Assigned:	Unassigned	» yash.rode
Status:	Needs review	» Needs work

#3344039: Add a validate() method to ComposerInspector to ensure that Composer is usable moved the constraint to a different place. This MR needs to be updated.

@yash.rode We did discuss this on Friday. In the future, please update the issue accordingly if I didn't. _{(I didn't because I was working on other issues non-stop after that meeting!)}

The conclusion was: support everything listed in https://endoflife.date/composer — that means the LTS (2.2) and the current version (2.5).

Comment #19

yash.rode commented 27 February 2023 at 13:29

The test is passing on my local but failing on drupal CI.

Comment #20

phenaproxima

he/him

English

Massachusetts

commented 27 February 2023 at 14:13

Title:

Change composer constraint to require supported versions

» Only support Composer ~2.2.12 (LTS) and ^2.5

Re-titling for clarity.

Comment #21

wim leers

Ghent 🇧🇪🇪🇺

commented 27 February 2023 at 16:07

👍 to what @phenaproxima said.

Let's also add an @see pointing to composer's security advisory.

Comment #22

effulgentsia commented 27 February 2023 at 16:21

Is the purpose of this issue solely to drop support for potentially insecure Composer versions, or was there something that Composer fixed in 2.2.12 and 2.5, but not in 2.3 or 2.4, and we rely on that fix? If the latter, what was that fix?

Comment #23

phenaproxima

he/him

English

Massachusetts

commented 27 February 2023 at 16:25

Title:

Only support Composer ~2.2.12 (LTS) and ^2.5

» Drop support for end-of-life versions of Composer

We already don't support Composer 2.2.11 or earlier, because of the security fix made in 2.2.12.

We currently support 2.3.5 and up, but 2.3 and 2.4 are EOL. So this is really just about dropping support for EOLed versions of Composer. Re-titling for clarity.

Comment #24

yash.rode commented 28 February 2023 at 11:23

Assigned:	yash.rode	» wim leers
Status:	Needs work	» Needs review

Comment #25

wim leers

Ghent 🇧🇪🇪🇺

commented 28 February 2023 at 12:27

Assigned:	wim leers	» Unassigned
Status:	Needs review	» Reviewed & tested by the community

This still did not yet address what I asked in #21:

Let's also add an @see pointing to composer's security advisory.

Given this is an alpha blocker, fixed that myself and slightly tightened test coverage for maximum confidence: now all boundaries are tested 👍

Comment #26

28 February 2023 at 12:56

phenaproxima committed 431d5344 on 3.0.x authored by yash.rode

Issue #3343889 by yash.rode, Wim Leers, phenaproxima, tedbow: Drop...

Comment #27

phenaproxima

he/him

English

Massachusetts

commented 28 February 2023 at 12:56

Status:

Reviewed & tested by the community

» Fixed

Glad to see this done! 🚀

Comment #28

14 March 2023 at 12:59

Status:

Fixed

» Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

Drop support for end-of-life versions of Composer

Problem/Motivation

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork automatic_updates-3343889

Comments

Referenced by