Bump composer/composer from 1.9.0 to 2.0.4

[dependabot-preview]

Bumps composer/composer from 1.9.0 to 2.0.4.

Release notes

Sourced from composer/composer's releases.

2.0.4

• Fixed check-platform-req command not being clear on what packages are checked, and added a --lock flag to explicitly check the locked packages
• Fixed config & create-project adding of repositories to make sure they are prepended as order is much more important in Composer 2, also added a --append flag to config to restore the old behavior in the unlikely case this is needed
• Fixed curl downloader failing on old PHP releases or when using self-signed SSL certificates
• Fixed Bitbucket API authentication issue

2.0.3

• Fixed bug in outdated command where dev packages with branch-aliases where always shown as being outdated
• Fixed issue in lock file interoperability with composer 1.x when using dev-master as xxx aliases
• Fixed new --locked option being missing from outdated command, for checking outdated packages directly from the lock file
• Fixed a few debug/error reporting strings

2.0.2

• Fixed regression handling composer show -s in projects where no version can be guessed from VCS
• Fixed regression handling partial updates/require when a lock file was missing
• Fixed interop issue with plugins that need to update dist URLs of packages, see docs if you need this

2.0.1

• Fixed crash on PHP8

2.0.0

Read the Composer 2.0 announcement first for the highlights!

Complete 2.0 Changelog

• Breaking: This is a major release and while we tried to keep things compatible for most users, you might want to have a look at the UPGRADE guides
• Many CPU and memory performance improvements
• The update command is now much more deterministic as it does not take the already installed packages into account
• Package installation now performs all network operations first before doing any changes on disk, to reduce the chances of ending up with a partially updated vendor dir
• Partial updates and require/remove are now much faster as they only load the metadata required for the updated packages
• Added a platform-check step when vendor/autoload.php gets initialized which checks the current PHP version/extensions match what is expected and fails hard otherwise. Can be disabled with the platform-check config option
• Added a Composer\InstalledVersions class which is autoloaded in every project and lets you check which packages/versions are present at runtime
• Added a composer-runtime-api virtual package which you can require (as e.g. ^2.0) to ensure things like the InstalledVersions class above are present. It will effectively force people to use Composer 2.x to install your project
• Added support for parallel downloads of package metadata and zip files, this requires that the curl extension is present and we thus strongly recommend enabling curl
• Added parallel installation of packages (requires OSX/Linux/WSL, and that unzip is present in PATH)
• Added much clearer dependency resolution error reporting for common error cases
• Added support for updating to a specific version with partial updates, as well as a --with flag to pass in temporary constraint overrides
• Added automatic removal of packages which are not required anymore whenever an update is done, this will purge packages previously left over by partial updates and require/remove
• Added support for TTY mode on Linux/OSX/WSL so that script handlers now run in interactive mode
• Added only, exclude and canonical options to all repositories, see repository priorities for details
• Added support for many new lib-* packages in the platform repository and improved version detection for some ext-* and lib-* packages
• Added pre-operations-exec event to be fired before the packages get installed/upgraded/removed
• Added pre-pool-create event to be fired before the package pool for the dependency solver is created, which lets you modify the list of packages going in
• Added post-file-download event to be fired after package dist files are downloaded, which lets you do additional checks on the files
• Added --locked flag to show command to see the packages from the composer.lock file
• Added --unused flag to remove command to make sure any packages which are not needed anymore get removed
• Added --dry-run flag to require and remove commands
• Added --no-install flag to update, require and remove commands to disable the install step and only do the update step (composer.lock file update)
• Added an --ask flag to create-project command to make Composer prompt for the install dir name, useful for project install instructions

Changelog

Sourced from composer/composer's changelog.

[2.0.4] 2020-10-30

• Fixed check-platform-req command not being clear on what packages are checked, and added a --lock flag to explicitly check the locked packages
• Fixed config & create-project adding of repositories to make sure they are prepended as order is much more important in Composer 2, also added a --append flag to config to restore the old behavior in the unlikely case this is needed
• Fixed curl downloader failing on old PHP releases or when using self-signed SSL certificates
• Fixed Bitbucket API authentication issue

[2.0.3] 2020-10-28

• Fixed bug in outdated command where dev packages with branch-aliases where always shown as being outdated
• Fixed issue in lock file interoperability with composer 1.x when using dev-master as xxx aliases
• Fixed new --locked option being missing from outdated command, for checking outdated packages directly from the lock file
• Fixed a few debug/error reporting strings

[2.0.2] 2020-10-25

• Fixed regression handling composer show -s in projects where no version can be guessed from VCS
• Fixed regression handling partial updates/require when a lock file was missing
• Fixed interop issue with plugins that need to update dist URLs of packages, see docs if you need this

[2.0.1] 2020-10-24

• Fixed crash on PHP8

[2.0.0] 2020-10-24

• Fixed proxy handling issues when combined with our new curl-based downloader
• Fixed solver bug resulting in endless loops in some cases
• Fixed solver output being extremely long due to learnt rules
• Fixed solver bug with multi literals
• Fixed a couple minor regressions

[2.0.0-RC2] 2020-10-14

• Breaking: Removed OperationInterface::getReason as the data was not accurate
• Added automatic removal of packages which are not required anymore whenever an update is done, this will purge packages previously left over by partial updates and require/remove
• Added shorthand aliases -w for --with-dependencies and -W for --with-all-dependencies on update/require/remove commands
• Added COMPOSER_DEBUG_EVENTS=1 env var support for plugin authors to figure out which events are triggered when
• Added setCustomCacheKey to PreFileDownloadEvent and fixed a cache bug for integrations changing the processed url of package archives
• Added Composer\Util\SyncHelper for plugin authors to deal with async Promises more easily
• Added $composer->getLoop()->getHttpDownloader() to get access to the main HttpDownloader instance in plugins
• Added a non-zero exit code (2) and warning to remove command when a package to be removed could not be removed
• Added --apcu-autoloader-prefix (or --apcu-prefix for dump-autoload command) flag to let people use apcu autoloading in a deterministic output way if that is needed
• Fixed version guesser to look at remote branches as well as local ones
• Lots of minor bug fixes and improvements

[2.0.0-RC1] 2020-09-10

• Added more advanced filtering to avoid loading all versions of all referenced packages when resolving dependencies, which should reduce memory usage further in some cases
• Added support for many new lib-* packages in the platform repository and improved version detection for some ext-* and lib-* packages

Commits

• 4053eab Release 2.0.4
• 5ad3d5a Update changelog
• da73ef1 Merge branch '1.10'
• f303419 Update changelog
• 28e591d Merge pull request #9387 from studioromeo/fix-git-non-master-default-failing-...
• 2ced7b0 Fix git init -b being unavailable for older versions
• 52f98fd Merge branch '1.10'
• 7f936d7 Ignore failures on preg_match for user supplied regex
• 36a9c47 Fix typo from a637072058c27d2fe4ccc13b71f81e025350a009
• a637072 Fix canUseCurl logic to allow local_cert/local_pk to reach curl, refs #9384
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[dependabot-preview]

Superseded by #82.