Hi!

When setting up a clean Magento 2.4.0 installation using composer followed up by bin/magento setup:install ..., I'm getting the following output which seems to be caused by this module.

...
[Progress: 653 / 1207]
Module 'Magento_CmsUrlRewriteGraphQl':
[Progress: 654 / 1207]
Module 'Magento_ComposerRootUpdatePlugin':
Installing data... Reading /project-root/composer.json
Loading config file /project-root/composer.json
Loading config file /project-root/auth.json
Reading /project-root/auth.json
Failed to initialize global composer: Composer could not find the config file: /project-root/var/composer_home/composer.json
To initialize a project, please create a composer.json file as described in the https://getcomposer.org/ "Getting Started" section
Reading /project-root/vendor/composer/installed.json
Reading /project-root/composer.lock
Checking for "magento/composer-root-update-plugin: 1.0.0" for the Web Setup Wizard...
Reading /project-root/var/vendor/magento/composer-root-update-plugin/composer.json
Loading config file /project-root/var/vendor/magento/composer-root-update-plugin/composer.json
No Web Setup Wizard update needed for magento/composer-root-update-plugin; version 1.0.0 is already in /project-root/var.
Upgrading data... Reading /project-root/composer.json
Loading config file /project-root/composer.json
Loading config file /project-root/auth.json
Reading /project-root/auth.json
Failed to initialize global composer: Composer could not find the config file: /project-root/var/composer_home/composer.json
To initialize a project, please create a composer.json file as described in the https://getcomposer.org/ "Getting Started" section
Reading /project-root/vendor/composer/installed.json
Reading /project-root/composer.lock
Checking for "magento/composer-root-update-plugin: 1.0.0" for the Web Setup Wizard...
Reading /project-root/var/vendor/magento/composer-root-update-plugin/composer.json
Loading config file /project-root/var/vendor/magento/composer-root-update-plugin/composer.json
No Web Setup Wizard update needed for magento/composer-root-update-plugin; version 1.0.0 is already in /project-root/var.

[Progress: 655 / 1207]
Module 'Magento_User':
...
[Progress: 951 / 1207]
Module 'Magento_CmsUrlRewriteGraphQl':
[Progress: 952 / 1207]
Module 'Magento_ComposerRootUpdatePlugin':
Running data recurring...Reading /project-root/composer.json
Loading config file /project-root/composer.json
Loading config file /project-root/auth.json
Reading /project-root/auth.json
Failed to initialize global composer: Composer could not find the config file: /project-root/var/composer_home/composer.json
To initialize a project, please create a composer.json file as described in the https://getcomposer.org/ "Getting Started" section
Reading /project-root/vendor/composer/installed.json
Reading /project-root/composer.lock
Checking for "magento/composer-root-update-plugin: 1.0.0" for the Web Setup Wizard...
Reading /project-root/var/vendor/magento/composer-root-update-plugin/composer.json
Loading config file /project-root/var/vendor/magento/composer-root-update-plugin/composer.json
No Web Setup Wizard update needed for magento/composer-root-update-plugin; version 1.0.0 is already in /project-root/var.

[Progress: 953 / 1207]
Module 'Magento_User':
...

Is this expected? Seems like a lot of noise.

What's the deal with this warning?

Failed to initialize global composer: Composer could not find the config file: /project-root/var/composer_home/composer.json
To initialize a project, please create a composer.json file as described in the https://getcomposer.org/ "Getting Started" section

Output when using Composer 2:

Creating a "magento/project-community-edition" project at "/tmp/exampleproject"
Installing magento/project-community-edition (2.4.1)
  - Downloading magento/project-community-edition (2.4.1)
  - Installing magento/project-community-edition (2.4.1): Extracting archive
Created project in /tmp/exampleproject
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires magento/composer-root-update-plugin ~1.0 -> satisfiable by magento/composer-root-update-plugin[1.0.0].
    - magento/composer-root-update-plugin 1.0.0 requires composer-plugin-api ^1.0 -> found composer-plugin-api[2.0.0] but it does not match the constraint.

On a Magento Open Source 2.4.4 install, magento/composer-dependency-version-audit-plugin version 2.0.2 is installed.

However, this repository hasn't been updated. The tag is missing, and, what's more, the code isn't there either.

Composer version 1.10.20 (as defined in dependency) has a security vulnerability.

composer/composer (1.10.20)

• CVE-2021-29472: Missing argument delimiter can lead to command execution via VCS repository URLs or source download URLs on systems with Mercurial https://github.com/composer/composer/security/advisories/GHSA-h5h8-pc6h-jvvx

This also fixes #23 (#24).

composer require magento/composer-root-update-plugin ~1.1 --no-update

./composer.json has been updated

composer update

Problem 1 - The requested package magento/composer-root-update-plugin ~1.1 exists as magento/composer-root-update-plugin[1.0.0, 0.1.1, 0.1.0] but these are rejected by your constraint.

Why do I get the following error?

Steps to reproduce:

• Try to install a package that has different versions between packagist.org and repo.magento.com - shipperhq/module-shipper is an example as of the time of writing

Expected Result:

• End users can download the newest version from packagist. A warning should be provided to check with the package maintainer that the version they've downloaded is correct.

Actual Outcome:

• End users get the error in the issue title and cannot proceed with install.

Recommended Resolution

• Downgrade this exception to a warning. Encourage the end user to reach out to the package maintainer to verify their version. Bonus points if Magento Marketplace just notifies the extension maintainer directly of the potential conflict or allows them to 'verify' the release is genuine.

Reasoning

It is a valid requirement for some extension providers to list their extensions in both the marketplace and in packagist. I think that discussion is out of the scope of this ticket anyway. It's technologically allowed regardless.

This error message is fundamentally flawed for a few reasons however.

First, packagist relies directly on the VCS repositories so it has access to new packages nearly instantaneously. However the Marketplaces EQP reviews can take several days to clear. This means there is potentially a SEVERAL DAY window where the package simply can't be installed. Now imagine if the package is under CI/CD and has a release cadance faster than the marketplace review. It will simply never be available.

Secondly the messaging on this error is all wrong. The messaging as it is written will spook the end user and erode trust in the extension maintainer even if no malicious user exists. Also I would assert that these implementation details should be surfaced to the end user who has not control over them. Doesn't it make more sense to make a best effort to resolve the conflict and/or provide a warning and then tell the extension provider that you think their account has been hacked? The optics of this message are terrible for extension providers, eroding confidence in their end users.

According requirements for Composer version: "composer/composer": "<=1.10.19 || >=2.0.0 <=2.0.8",

It's strict requirements and require to create new package version for each patch Composer upgrade with important fixes.

I suggest to change requirement to less strict and release new version in minor version change, like: "composer/composer": "< 1.11 || ~2.0.0",

Please review suggestion or add 1.10.20 and 2.0.9 to supported version list. Thank you!

In Composer 1.10.21 a patch was introduced for an issue related to the new OAuth token format that GitHub started using. https://github.com/composer/composer/commit/dc83ba93f3d8a35629f9a387632e8cd373a144d0

The plugin is not compatible with the latest version of MCD

Steps to reproduce

TBA

"magento/composer-root-update-plugin: 1.1.0" for the Web Setup Wizard...
Reading /app/var/vendor/magento/composer-root-update-plugin/composer.json
Loading config file /app/var/vendor/magento/composer-root-update-plugin/composer.json
No Web Setup Wizard update needed for magento/composer-root-update-plugin; version 1.1.0 is already in /app/var.

Root cause analysis

• It looks like the plugin exits with non-zero code which later results in broken deployment

composer require magento/product-enterprise-edition 2.3.6 --base-magento-edition Commerce --base-magento-version 2.3.5-p2

Error:

  Problem 1
    - Can only install one of: magento/page-builder-commerce[1.3.3, 1.3.2].
    - Can only install one of: magento/page-builder-commerce[1.3.2, 1.3.3].
    - Can only install one of: magento/page-builder-commerce[1.3.3, 1.3.2].
    - magento/product-enterprise-edition 2.3.6 requires magento/page-builder-commerce 1.3.3 -> satisfiable by magento/page-builder-commerce[1.3.3].
    - Installation request for magento/product-enterprise-edition 2.3.6 -> satisfiable by magento/product-enterprise-edition[2.3.6].
    - Installation request for magento/page-builder-commerce (locked at 1.3.2, required as ~1.3.2) -> satisfiable by magento/page-builder-commerce[1.3.2].

The current version of Composer is 1.10.8. This repository specifically only supports Composer up to 1.10.6. Any reason? I do understand that you cannot easily support Composer 2, but shouldn't the latest Composer 1 version be supported? :)

Deprecation Notice: preg_match(): Passing null to parameter #2 ($subject) of type string is deprecated in /home/xxx/public_html/vendor/magento/composer-root-update-plugin/Utils/PackageUtils.php:128

I'm hitting this error when trying to use require-commerce:

app@5e70488a62a9:~/html$ composer require-commerce magento/product-enterprise-edition 2.4.4

In RootPackageRetriever.php line 526:
                                                                                                                                                 
  [TypeError]                                                                                                                                    
  Return value of Magento\ComposerRootUpdatePlugin\Updater\RootPackageRetriever::getOriginalVersion() must be of the type string, null returned  
                                                                                                                                                 

Exception trace:
  at /var/www/html/vendor/magento/composer-root-update-plugin/Updater/RootPackageRetriever.php:526
 Magento\ComposerRootUpdatePlugin\Updater\RootPackageRetriever->getOriginalVersion() at /var/www/html/vendor/magento/composer-root-update-plugin/Updater/RootProjectUpdater.php:81
 Magento\ComposerRootUpdatePlugin\Updater\RootProjectUpdater->runUpdate() at /var/www/html/vendor/magento/composer-root-update-plugin/Plugin/Commands/RequireCommerceCommand.php:231
 Magento\ComposerRootUpdatePlugin\Plugin\Commands\RequireCommerceCommand->runUpdate() at /var/www/html/vendor/magento/composer-root-update-plugin/Plugin/Commands/RequireCommerceCommand.php:162
 Magento\ComposerRootUpdatePlugin\Plugin\Commands\RequireCommerceCommand->execute() at phar:///usr/local/bin/composer/vendor/symfony/console/Command/Command.php:298
 Symfony\Component\Console\Command\Command->run() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:1015
 Symfony\Component\Console\Application->doRunCommand() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:299
 Symfony\Component\Console\Application->doRun() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:334
 Composer\Console\Application->doRun() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:171
 Symfony\Component\Console\Application->run() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:130
 Composer\Console\Application->run() at phar:///usr/local/bin/composer/bin/composer:88
 require() at /usr/local/bin/composer:29

Composer version:

app@5e70488a62a9:~/html$ composer --version
Composer version 2.3.4 2022-04-07 21:16:35

PHP version:

app@5e70488a62a9:~/html$ php -v
PHP 7.4.25 (cli) (built: Oct 22 2021 17:44:39) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with Zend OPcache v7.4.25, Copyright (c), by Zend Technologies
    with the ionCube PHP Loader + ionCube24 v11.0.0, Copyright (c) 2002-2021, by ionCube Ltd.
    with Xdebug v3.1.1, Copyright (c) 2002-2021, by Derick Rethans
    with blackfire v1.68.1~linux-x64-non_zts74, https://blackfire.io, by Blackfire

as with direct download including a hash its already protected enough

// just reporting as I saw multiple reports in various chats triggered by the new release of magento/composer

reported here, because thats the repository linked from https://magento.com/blog/best-practices/adobe-releases-new-composer-plugin-magento-243-release if its belonging into a different, please advise/forward (does it belong to https://github.com/magento/composer-dependency-version-audit-plugin ?)

When will it be possible to use composer with php 8 ? Its a hassle to change php version just to use the composer every time.

magento/composer-root-update-plugin 2.0.0 requires php ~7.3.0||~7.4.0 -> your php version (8.0.13) does not satisfy that requirement.