Composer version requirements are not checked against Drupal version-related requirements #660
Description
ScriptHandler.php has checkComposerVersion() method to check the version of Composer.
Currently, it only checks that Composer is at least version 1.0.0. This was added in 2016 and is no longer a sufficient version for Drupal 10+. See https://www.drupal.org/docs/system-requirements/composer-requirements
Drupal 10 will require Composer 2.3.6 or higher, since this will be the requirement for using Automatic Updates. Composer can be updated by running composer self-update.
Older versions of Composer may continue to install or update Drupal successfully but bug reports will only be accepted for supported versions.
Since this check is failing to correctly check for the requirements, users with outdated version of Composer have their dependencies silently resolved to older versions, resulting in requirements conflicts:
Your requirements could not be resolved to an installable set of packages.
Problem 1
- drush/drush[12.4.3, ..., 12.x-dev] require composer-runtime-api ^2.2 -> found composer-runtime-api[2.1.0] but it does not match the constraint.
- Root composer.json requires drush/drush ^12.4.3 -> satisfiable by drush/drush[12.4.3, ..., 12.x-dev].
We need to update the version constant in checkComposerVersion() and add a test in CI to check that the version resolution works correctly (we need a negative test).