DT-1399: Evaluate Composer 2.0 readiness.

[danepowell]

Known blockers:

• Composer 2.0 compatibility composer/installers#447
• Composer 2.x compatibility PHPCSStandards/composer-installer#108
• Add support for Composer version 2 cweagans/composer-patches#309
• Adding support for Composer 2. grasmash/drupal-security-warning#8
• Support for Composer 2 zaporylie/composer-drupal-optimizations#16 (just remove this plugin)
• Support for Composer 2 mglaman/drupal-check#160
• https://www.drupal.org/project/drupal/issues/3126566
• Create new release to fix deprecation warnings FloeDesignTechnologies/phpcs-security-audit#78

[wimleers]

This is a huge BC break and caused more than a dozen of hours of time spent debugging acquia/acquia_migrate#184 😭

[danepowell]

Sorry to cause you grief, but just to be clear this only happened in the 12.x branch which is explicitly unstable and unsupported. However we just cut 12.0.0-alpha1 and I don't foresee any more BC breaks, although they could still happen.

[danepowell]

Also I suppose this is an example of the paradigm that if you rely on a dependency, you should declare it, even if you already get it "for free" from some upstream package. You might want to see what else BLT is providing that you rely on, and make sure that you explicitly declare the dependency yourself.

[wimleers]

but just to be clear this only happened in the 12.x branch which is explicitly unstable and unsupported

But we're explicitly building a stable product on top of Drupal 9 over at https://github.com/acquia/migrate.

We must use https://github.com/acquia/orca.

https://github.com/acquia/orca requires us to use https://github.com/acquia/blt, and specifically version 12 to test with Drupal 9.

So I don't see how we have any choice here?

I think we can be pragmatic here: explicitly ping me whenever there's a BC break being introduced in BLT 12, so that we can make whatever changes we need to not break the build, or only break it for a brief period of time :)

[wimleers]

Also I suppose this is an example of the paradigm that if you rely on a dependency, you should declare it, even if you already get it "for free" from some upstream package.

This is totally fair! :)