Tests failing because of composer 2.9

[rfay]

Preliminary checklist

• I am using the latest stable version of DDEV
• I am using the latest stable version of this add-on

Expected Behavior

Tests are failing due to composer 2.9, see:

https://github.com/ddev/ddev-drupal-contrib/actions/runs/19358983935/job/55386135763#step:3:228

# - Root composer.json requires drupal/core-recommended 11 (exact version match: 11, 11.0, 11.0.0 or 11.0.0.0), found drupal/core-recommended[11.0.0] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-4txt-syt7-f859", "PKSA-ckr2-ndkc-nts3", "PKSA-vt8m-56zm-d92y", "PKSA-hc46-z535-fjfk", "PKSA-35hc-pd1y-zwpc") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

There's lots of carnage from composer 2.9, https://github.com/composer/composer/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen

I imagine this will affect Drupal devs in general.

[rfay]

I think what's required is to put this in the composer.json or the global ~/.composer/config.json

{
    "config": {
        "audit": {
            "block-insecure": false
        }
    }
}

• https://getcomposer.org/doc/06-config.md#block-insecure
• https://blog.packagist.com/composer-2-9/
• https://github.com/composer/composer/releases/tag/2.9.0

This can also be done in the short term with ddev config --composer-version=2.8.12 or composer_version: 2.8.12

We do expect some of the open issues to result in a simpler way to solve this.

[rfay]

Thanks!