Add support for Composer 2

[hostep]

https://github.com/magento/magento-composer-installer needs to be updated to support Composer 2

According to https://github.com/composer/composer/issues/8726#issuecomment-691097291 the Magento composer plugin is the 3rd most used composer plugin not yet supporting Composer 2.

https://github.com/magento/composer-root-update-plugin/ is also not compatible yet from what I can see.

Then you'll probably need to port this fix over as well: https://github.com/Cotya/magento-composer-installer/commit/b5b19fe9e84c7775aa28764606d52c1e5c445c1d (see https://github.com/Cotya/magento-composer-installer/issues/182 for context)

And https://github.com/magento/zf1/pull/29 is also needed.

Maybe other parts in Magento also needs updates for Composer 2, but since the Web Set Up Wizard was removed in Magento 2.4.0, it will need much less work I guess...

Would be nice if this could get achieved soon, since the Composer 2 release seems to get closer now that RC1 was released about 2 weeks ago.

[m2-assistant[bot]]

Hi @hostep. Thank you for your report. To help us process this issue please make sure that you provided sufficient information.

Please, add a comment to assign the issue: @magento I am working on this

---

• Join Magento Community Engineering Slack and ask your questions in #github channel.

[hostep]

@sivaschenko: RC2 was released yesterday and they announced that the stable version is expected very soon:

The current plan is to release a 2.0 final before end of October. It is almost 100% compatible with Composer 1 with the exception of plugins, so please do try it ASAP and report any regression you find. The lock files from v1 can be used by v2 and vice-versa, so don't worry about that.

So would be nice if we start looking into this and not wait on development for Magento 2.5 to start up which is probably still more then a year away ... Or is there something in Magento which prevents us from introducing composer 2 support without breaking backwards compatibility?

[manobi]

I have a lot a projects that will break with composer self updating soon (CI/CD pipelines). Since composer 2 have a lot of improvements, I would love to have compatibility before 2.5.

[hostep]

@manobi: I saw the same auto-self-update message last week. But it looks like if you update composer to 1.10.15 (last v1 version at the time of writing), it no longer outputs that auto-self-update message, so I think if you update your CI/CD pipelines to the latest v1 version, composer should not auto-update to v2

[manobi]

@hostep Thank you for the tip, I'll try that!

Composer v2.0 introduced the option to pass --json argument to composer config, which would be really awesome to use applying patches:

composer config --json extra.patches "$(cat patches/composer/main.json)"

[PascalBrouwers]

Yes, please merge as soon as possible :)

[hostep]

And Composer v2 was just released 🥳 https://github.com/composer/composer/releases/tag/2.0.0

[davidncuba]

Anybody fix this issue?

[jissereitsma]

Quoting from https://blog.packagist.com/composer-2-0-is-now-available/ : "As for Composer 1.x, it is now more or less EOL. It will also receive critical fixes if anything comes up but the goal for everyone should be to migrate to 2.x as soon as possible."

I think therefore upgrading the Magento plugin should receive a higher priority, instead of just waiting for Magento 2.4.2 or later.

[maghamed]

Hey guys, Magento Dev Guild started to work on analysis and pre-requisites for upgrade. Taking into account the state of Composer 1, which is looks like being considered as EOL, this task got high priority. We will keep you updated on our further steps and when you can expect support of Composer 2 in Magento.

[jissereitsma]

To comment on things quickly, adding the composer flag --ignore-platform-reqs allows for using Composer 2 already just fine. Setting the canonical flag to false seems to work nicely with some custom repositories, but in my case it was not needed for the Magento Marketplace (ref: https://blog.bitexpert.de/blog/fast-faster-composer2/)

[shochdoerfer]

@jissereitsma IIRC you don't need the flag if the packages are located in just one repository source.

[hostep]

Another interesting PR which could serve as inspiration: https://github.com/Cotya/magento-composer-installer/pull/192

[scottsb]

@jissereitsma What you describe sounds like it would allow Composer 2.0 commands to complete, but does Magento seem to be running reliably after being installed that way? Per magento/zf1#29 that @hostep pointed out initially, it seems that certain required files may not get autoloaded correctly. (On the other hand, that particular class doesn't appear to actually be used by Magento, so the warning might just be noise.)

[jissereitsma]

@scottsb I'm not an authority here. I always thought the Magento Composer Installer added nothing more than an optional extra section in the composer.json file, but reading through its contents, I can also see that perhaps some language packs or themes installed via composer might have issues. However, I thought this was handled by the registration.php calls already ... Someone would need to test that out.

The https://github.com/magento/zf1/pull/29 issue reflects a warning in the composer optimization. Indeed the class Zend_Validate_Barcode_IntelligentMail will not load correctly anymore. But it is not used anywhere in the core packages. It simply sits there as part of ZF1 included in the Magento install.

There are still other Zend dependencies in the Magento core, but those are included in ZF1 as well. No harm here, so far.

The Magento Composer Root Update plugin would need to be updated as well, but if this does not work, one needs to go through the composer.json file manually after Magento upgrades, like before.

As far as I can see, these are not major issues. Still, it would be nice if all plugins are again working nicely.

[JosephLeedy]

Any updates on the status of this issue?

[sivaschenko]

@JosephLeedy The implementation is in progress, I believe Composer 2.0 support is part of 2.5 release scope.

[JosephLeedy]

In my humble opinion, 2.4.2 or 2.4.3 should be the target for this. Waiting until 2.5 is just way too late in the game.

The biggest issue that I am seeing right now is confusion with new developers on the right version of Composer to install. By default, the Composer installer installs 2.0, but when they try to install Magento for the first time, they get compatibility errors. They then have to figure out that they need Composer 1.x and somehow have to downgrade to it. For me that's an easy task, but for someone who doesn't know Composer from Git, it can be difficult to figure out.

Another point of confusion with Composer 1.x is that it tells you you're using the wrong version, and if you update, you get 2.0 unless you pass the --1 flag.

[markshust]

@JosephLeedy The implementation is in progress, I believe Composer 2.0 support is part of 2.5 release scope.

When is 2.5 due to be released? I didn't see it in the list of planned releases.

[shochdoerfer]

Just for the sake of completeness: The Composer 2.0 upgrade will not only be good for us users but also for the infrastructure. Composer 2.0 consumes a lot less bandwidth. Jordi and Nils have highlighted this in their talk at Symfony world: https://twitter.com/velmu/status/1334807052263284737

[hostep]

@sivaschenko or @maghamed, out of curiosity: is there code inside Magento core itself which is incompatible with composer version 2?

If not, then only the composer plugins Magento uses needs to get updated and we don't need a new Magento version at all. We could then in theory use composer version 2 on older Magento versions as well which would be awesome.

@markshust

When is 2.5 due to be released? I didn't see it in the list of planned releases.

From what I understood from various blog posts and video's from the Magento community team, this should happen in April 2022 when support for Magento 2.3 stops (but I may have understood it incorrectly). So that's obviously way too late for composer v2 support 🙂

[hostep]

I'm going to close this ticket since composer v2 support will land in Magento 2.4.2 which is going to be released on 9 February 2021. I can already confirm it works in the pre-release they made available yesterday to partners.

If somebody is interested in getting composer v2 support on older Magento2 versions, you can try the following instructions in https://gist.github.com/hostep/26de0bf2bb695eb3b6d51858c2e4562e (not thoroughly tested though, use at your own risk!)

[kassner]

This means Magento 2.3 will be running with an unsupported version for over a year, which I believe warrants having this ticket open for a little while.

[hostep]

@kassner: @maghamed told me on Slack that compsoser v2 support will most likely come to Magento 2.3.7 as well (release date: 11 May 2021)

[Eddcapone]

Magento 2.4.2 is still missing support for composer 2. I get:

Loading composer repositories with package information                                                                                                                                 In Laminas\DependencyPlugin\DependencyRewriterV2::onPrePoolCreate
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires dealerdirect/phpcodesniffer-composer-installer ^0.5.0 -> satisfiable by dealerdirect/phpcodesniffer-composer-installer[v0.5.0].
    - dealerdirect/phpcodesniffer-composer-installer v0.5.0 requires composer-plugin-api ^1.0 -> found composer-plugin-api[2.0.0] but it does not match the constraint.

It works with composer 1

[JosephLeedy]

Make sure that your dependencies in require-dev are correct.

[Seldaek]

@Eddcapone you have a require on dealerdirect/phpcodesniffer-composer-installer ^0.5.0 which as per semver treats 0.x versions as major, so it does not allow upgrading past 0.5.x. Make sure you change that to ^0.7 to get the composer-2-supporting release.

[Eddcapone]

@Seldaek , thank you. it works now!