Bump composer/composer from 2.0.13 to 2.4.4

[dependabot[bot]]

Bumps composer/composer from 2.0.13 to 2.4.4.

Release notes

Sourced from composer/composer's releases.

2.4.4

• Added extra debug output when a zip extraction fails while on GitHub Actions (#11148)
• Fixed cache write failures when the cache dir gets removed during a composer run (#11076)
• Fixed 2.4.3 regression in loading Composer on SMB/network shares (#11077)
• Fixed --dry-run flag missing from bump command (#11047)
• Fixed status command reporting differences when the source ref is a tag (#11155)
• Fixed outdated command outputting legend on stdout instead of stderr
• Fixed URL sanitizer to handle new GitHub personal access tokens format (#11137)

2.4.3

• BC Break: The json format of audit command now has reportedAt as an RFC3339 string instead of an object which was a mistake (#11120)
• Fixed json format of audit command which was missing affectedVersions (#11120)
• Fixed plugin commands not being loaded during bash completions (#11074)
• Fixed parsing of inline aliases within complex constraints with || or , (#11086)
• Fixed min-php version check in autoload.php to avoid crashing sites running on PHP 5.5 or below silently with a 200 (#11091)
• Fixed JsonFile reading files without checking if they are readable first (#11077)
• Fixed require command with --dry-run failing when requiring a package requiring stability flag extraction (#11112)

2.4.2

• Fixed bash completion hanging when running as root without COMPOSER_ALLOW_SUPERUSER set (#11024)
• Fixed handling of plugin activation when running as root without COMPOSER_ALLOW_SUPERUSER set so it always happens after prompting, or does not happen if input is non-interactive
• Fixed package filter on bump command (#11053)
• Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules (#11037)
• Fixed handling of COMPOSER_DISCARD_CHANGES when set to 0
• Fixed handling of zero-major versions in outdated command with --major-only (#11032)
• Fixed show --platform regression since 2.4.0 when running in a directory without composer.json (#11046)
• Fixed a few strict type errors

2.4.1

• Added a COMPOSER_NO_AUDIT env var to easily apply the new --no-audit flag in CI (#10998)
• Fixed show command showing packages in two sections, this was only meant for the outdated command (#11000)
• Fixed local git repos being copied to cache unnecessarily (#11001)
• Fixed git cache invalidation issue when a git tag gets created after the cache has loaded a given reference (#11004)

2.4.0

Read the Composer 2.4 Release Announcement for more details on the release highlights.

Complete Changelog

• Added bash completions for Composer commands, package names, etc (see how to setup) (#10320)
• Added bump command to bump requirements to the currently installed version (#10829)
• Added audit command to check for known security vulnerabilities in installed packages (#10798, #10898)
• Added automatic auditing of security vulnerabilities after update is done, can be overridden with --no-audit (#10798, #10898)
• Added --audit to install command to also do an audit (#10798, #10898)
• Added json format output to the check-platform-reqs command (#10979)
• Added GitLab 15+ token refresh support (#10988)
• Added r alias to require command (#10953)
• Added composer/class-map-generator dependency to replace Composer\Autoload\ClassMapGenerator which is now deprecated (#10885)
• Added --locked to depends/prohibits commands (#10834)

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.4.4] 2022-10-27

• Added extra debug output when a zip extraction fails while on GitHub Actions (#11148)
• Fixed cache write failures when the cache dir gets removed during a composer run (#11076)
• Fixed 2.4.3 regression in loading Composer on SMB/network shares (#11077)
• Fixed --dry-run flag missing from bump command (#11047)
• Fixed status command reporting differences when the source ref is a tag (#11155)
• Fixed outdated command outputting legend on stdout instead of stderr
• Fixed URL sanitizer to handle new GitHub personal access tokens format (#11137)

[2.4.3] 2022-10-14

• BC Break: The json format of audit command now has reportedAt as an RFC3339 string instead of an object which was a mistake (#11120)
• Fixed json format of audit command which was missing affectedVersions (#11120)
• Fixed plugin commands not being loaded during bash completions (#11074)
• Fixed parsing of inline aliases within complex constraints with || or , (#11086)
• Fixed min-php version check in autoload.php to avoid crashing sites running on PHP 5.5 or below silently with a 200 (#11091)
• Fixed JsonFile reading files without checking if they are readable first (#11077)
• Fixed require command with --dry-run failing when requiring a package requiring stability flag extraction (#11112)

[2.4.2] 2022-09-14

• Fixed bash completion hanging when running as root without COMPOSER_ALLOW_SUPERUSER set (#11024)
• Fixed handling of plugin activation when running as root without COMPOSER_ALLOW_SUPERUSER set so it always happens after prompting, or does not happen if input is non-interactive
• Fixed package filter on bump command (#11053)
• Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules (#11037)
• Fixed handling of COMPOSER_DISCARD_CHANGES when set to 0
• Fixed handling of zero-major versions in outdated command with --major-only (#11032)
• Fixed show --platform regression since 2.4.0 when running in a directory without composer.json (#11046)
• Fixed a few strict type errors

[2.4.1] 2022-08-20

• Added a COMPOSER_NO_AUDIT env var to easily apply the new --no-audit flag in CI (#10998)
• Fixed show command showing packages in two sections, this was only meant for the outdated command (#11000)
• Fixed local git repos being copied to cache unnecessarily (#11001)
• Fixed git cache invalidation issue when a git tag gets created after the cache has loaded a given reference (#11004)

[2.4.0] 2022-08-16

• Added json format output to the new audit command (#10965)
• Added json format output to the check-platform-reqs command (#10979)
• Added GitLab 15+ token refresh support (#10988)
• Fixed COMPOSER_NO_DEV so it also works with require and remove's --update-no-dev (#10995)
• Fixed various bash completion issues

[2.4.0-RC1] 2022-07-21

• Added bash completions for Composer commands, package names, etc (see how to setup) (#10320)
• Added bump command to bump requirements to the currently installed version (#10829)

... (truncated)

Commits

• e8d9087 Release 2.4.4
• 4900a14 Update changelog
• bb726b8 Fix status command reporting differences when source reference is a tag name,...
• 10e757d Add extra debug info when running GH Actions and an archive extraction fails,...
• 923ff98 Update phpstan
• 90673e4 Update URL masking patterns for new GitHub fine-grained PATs
• 8554731 Fix regression in loading Composer on SMB/network shares, refs #8231 #11077
• 803e4e5 Catch runtime exception while initializing Composer to make sure a missing co...
• e5b8f2d Add "--dry-run" to bump command (#11047)
• 8d3a304 Fix outdated command outputting some of the legend to stdout
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot[bot]]

Superseded by #514.