Composer version 2.2.5 might break Contao installations

[ben-eSM]

Affected version(s)

all

Description

Due to the new handling regarding the composer/package-versions-deprecated plugin introduced in Composer version 2.2.5 (see Pull Request #10458), there's a chance that the vendor/composer/package-versions-deprecated/src/PackageVersions/Versions.php file contains an empty VERSIONS constant. That could lead to errors like There is no "contao-components/*" asset package.

I just had two installations where composer was updated from 2.1.x to 2.2.5 which lead to this issue.

[ausi]

Accessing this constant does not seem to be an intended use case, see https://github.com/composer/package-versions-deprecated/blob/b4f54f74ef3453349c24a845d22392cd31e65f1d/src/PackageVersions/Installer.php#L66 so we probably have to change this.

[ausi]

We should probably add a check like method_exists(InstalledVersions::class, 'getInstalledPackagesByType') and use the implementation from Contao 4.13 in this case:

contao/core-bundle/src/DependencyInjection/Compiler/AddAssetsPackagesPass.php

Line 87 in d0a7512

foreach (InstalledVersions::getInstalledPackagesByType('contao-component') as $name) {

and only use the current code as a fallback if the method does not exist.

[ausi]

For everyone else experiencing this issue: Downgrading to Composer 2.2.4 (e.g. via composer self-update 2.2.4) can be a way to workaround this issue for now.

[ben-eSM]

For everyone else experiencing this issue: Downgrading to Composer 2.2.4 (e.g. via composer self-update --rollback) can be a way to workaround this issue for now.

I can confirm that. composer self-update 2.2.4 does the trick.

[ausi]

Closed in favor of #4020

[ausi]

It would be great if someone could verify that the changes from #4020 work in a setup that is currently broken.