Installation broken with Composer 2 (sculpin/sculpin-theme-composer-plugin requires legacy composer-plugin-api)

[clue]

Problem

Composer 2 has been released this weekend. Unfortunately, installing any Sculpin-based site currently fails when using Composer 2:

$ composer create-project sculpin/sculpin
Creating a "sculpin/sculpin" project at "./sculpin"
Installing sculpin/sculpin (3.0.3)
  - Installing sculpin/sculpin (3.0.3): Extracting archive
Created project in /home/me/workspace/clue-rq/sculpin
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Your lock file does not contain a compatible set of packages. Please run composer update.

  Problem 1
    - sculpin/sculpin-theme-composer-plugin is locked to version v1.0.2 and an update of this package was not requested.
    - sculpin/sculpin-theme-composer-plugin v1.0.2 requires composer-plugin-api ^1.1 -> found composer-plugin-api[2.0.0] but it does not match the constraint.
  Problem 2
    - ocramius/package-versions is locked to version 1.4.2 and an update of this package was not requested.
    - ocramius/package-versions 1.4.2 requires composer-plugin-api ^1.0.0 -> found composer-plugin-api[2.0.0] but it does not match the constraint.
  Problem 3
    - ocramius/package-versions 1.4.2 requires composer-plugin-api ^1.0.0 -> found composer-plugin-api[2.0.0] but it does not match the constraint.
    - jean85/pretty-package-versions 1.2 requires ocramius/package-versions ^1.2.0 -> satisfiable by ocramius/package-versions[1.4.2].
    - jean85/pretty-package-versions is locked to version 1.2 and an update of this package was not requested.

Use the option --with-all-dependencies to allow upgrades, downgrades and removals for packages currently locked to specific versions.

ocramius/package-versions only provides support for Composer 2 in 1.8+, which requires PHP 7.4.
If you can not upgrade PHP you can require composer/package-versions-deprecated to resolve this with PHP 7.0+.

You are using Composer 2, which some of your plugins seem to be incompatible with. Make sure you update your plugins or report a plugin-issue to ask them to support Composer 2.

This weekend, Travis CI started shipping Composer 2 for PHP 7.4, so this has potential to break many existing builds. PHP 7.3 and older still use Composer 1 on Travis CI. Other CI systems may or may not make the same decision of course.

Analysis

The same installation instructions work just fine using Composer 1. The error output leads us to see this is actually an issue (outstanding upgrade) in sculpin/sculpin-theme-composer-plugin rather than the main sculpin/sculpin package. I figured posting here gives this problem more visibility (plus, most sites would only directly depend on this main package).

sculpin/sculpin-theme-composer-plugin v1.0.2 requires composer-plugin-api ^1.1

Upgrading this package shouldn't be too much work according to Composer's upgrade docs. It looks like this would be a matter of adding a dummy uninstall() and deactivate() method, so this could potentially also be made compatible with both Composer 1 and Composer 2 without too much work. Unfortunately, that code does not currently ship any tests and I don't see any changes having any effect on my site, so I don't feel comfortable taking a stab at a PR and I'm only leaving this as a heads-up here for the time being.

• https://php.watch/articles/composer-2#plugin-api-2
• https://github.com/composer/composer/blob/7fcf559f622256e0ee4ab920459eb47b848b4706/UPGRADE-2.0.md#for-integrators-and-plugin-authors
• Ecosystem Upgrade: Composer Plugin Readiness for 2.0 composer/composer#8726

Work around

Fortunately, working around this problem temporarily is easy for most(?) sites using Sculpin.

You can simply downgrade to Composer 1 and the installation should work just fine again.

As an alternative, my site doesn't appear to actually require the conflicting sculpin/sculpin-theme-composer-plugin package (I make no use of any themes whatsoever and only use custom templates). This means I can configure Composer to ignore (replace with nothing) this affected package without causing any noticeable effects (comparing the build output and generated HTML) like this:

{
    "replace": {
        "sculpin/sculpin-theme-composer-plugin": "1.0.2"
    }
}

[beryllium]

Thanks for this report! I've started a PR to get it fixed - and the suggested workaround was very helpful for getting some internal sculpin sites up and running at work this afternoon.

[opdavies]

the suggested workaround was very helpful

Likewise, I've been able to deploy some updates for a client site on Netlify, the build for which was failing.