Bump composer/composer from 1.10.10 to 2.2.21

[dependabot]

Bumps composer/composer from 1.10.10 to 2.2.21.

Release notes

Sourced from composer/composer's releases.

2.2.21

• Fixed extra.plugin-optional support in PluginInstaller when doing pre-install checks (#11326)

2.2.20

• Added extra.plugin-optional support for allow auto-disabling unknown plugins which are not critical when running non-interactive (#11315)

2.2.19

• Fixed URL sanitizer to handle new GitHub personal access tokens format (#11137)
• Fixed cache keys to allow _ to avoid conflicts between package names like a-b and a_b (#11229)
• Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules (#11037)
• Fixed handling of COMPOSER_DISCARD_CHANGES when set to 0

2.2.18

• Fixed COMPOSER_NO_DEV so it also works with require and remove's --update-no-dev (#10995)
• Fixed duplicate missing extension warnings being displayed (#10938)
• Fixed hg version detection (#10955)
• Fixed git cache invalidation issue when a git tag gets created after the cache has loaded a given reference (#11004)

2.2.17

PSA: If you are seeing issues running non-interactive create-project with a project that does not configure allow-plugins, see the top post of #10928 for a workaround.

• Fixed plugins from CWD/vendor being loaded in some cases like create-project or validate even though the target directory is outside of CWD (#10935)
• Fixed support for legacy (Composer 1.x, e.g. hirak/prestissimo) plugins which will not warn/error anymore if not in allow-plugins, as they are anyway not loaded (#10928)
• Fixed pre-install check for allowed plugins not taking --no-plugins into account (#10925)
• Fixed support for disable_functions containing disk_free_space (#10936)
• Fixed RootPackageRepository usages to always clone the root package to avoid interoperability issues with plugins (#10940)

2.2.16

• Fixed non-interactive behavior of allow-plugins to throw instead of continue with a warning to avoid broken installs (#10920)
• Fixed allow-plugins BC mode to ensure old lock files created pre-2.2 can be installed with only a warning but plugins fully loaded (#10920)
• Fixed deprecation notice (#10921)

2.2.15

• Fixed support for cache-read-only where the filesystem is not writable (#10906)
• Fixed type error when using allow-plugins: true (#10909)
• Fixed @​putenv scripts receiving arguments passed to the command (#10846)
• Fixed support for spaces in paths with binary proxies on Windows (#10836)
• Fixed type error in GitDownloader if branches cannot be listed (#10888)
• Fixed RootPackageInterface issue on PHP 5.3.3 (#10895)

2.2.14

• Fixed handling of broken symlinks when checking whether a package is still installed (#6708)
• Fixed name validation regex in schema causing issues with JS IDEs like VS Code (#10811)
• Fixed bin proxies to allow a proxy to include another one safely (#10823)
• Fixed gitlab-token JSON schema definition (#10800)
• Fixed openssl 3.x version parsing as it is now semver compliant
• Fixed type error when a json file cannot be read (#10818)
• Fixed parsing of multi-line arrays in funding.yml (#10784)

2.2.13

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.2.21] 2023-02-15

• Fixed extra.plugin-optional support in PluginInstaller when doing pre-install checks (#11326)

[2.2.20] 2023-02-10

• Added extra.plugin-optional support for allow auto-disabling unknown plugins which are not critical when running non-interactive (#11315)

[2.2.19] 2023-02-04

• Fixed URL sanitizer to handle new GitHub personal access tokens format (#11137)
• Fixed cache keys to allow _ to avoid conflicts between package names like a-b and a_b (#11229)
• Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules (#11037)
• Fixed handling of COMPOSER_DISCARD_CHANGES when set to 0

[2.2.18] 2022-08-20

• Fixed COMPOSER_NO_DEV so it also works with require and remove's --update-no-dev (#10995)
• Fixed duplicate missing extension warnings being displayed (#10938)
• Fixed hg version detection (#10955)
• Fixed git cache invalidation issue when a git tag gets created after the cache has loaded a given reference (#11004)

[2.2.17] 2022-07-13

• Fixed plugins from CWD/vendor being loaded in some cases like create-project or validate even though the target directory is outside of CWD (#10935)
• Fixed support for legacy (Composer 1.x, e.g. hirak/prestissimo) plugins which will not warn/error anymore if not in allow-plugins, as they are anyway not loaded (#10928)
• Fixed pre-install check for allowed plugins not taking --no-plugins into account (#10925)
• Fixed support for disable_functions containing disk_free_space (#10936)
• Fixed RootPackageRepository usages to always clone the root package to avoid interoperability issues with plugins (#10940)

[2.2.16] 2022-07-05

• Fixed non-interactive behavior of allow-plugins to throw instead of continue with a warning to avoid broken installs (#10920)
• Fixed allow-plugins BC mode to ensure old lock files created pre-2.2 can be installed with only a warning but plugins fully loaded (#10920)
• Fixed deprecation notice (#10921)

[2.2.15] 2022-07-01

• Fixed support for cache-read-only where the filesystem is not writable (#10906)
• Fixed type error when using allow-plugins: true (#10909)
• Fixed @​putenv scripts receiving arguments passed to the command (#10846)
• Fixed support for spaces in paths with binary proxies on Windows (#10836)
• Fixed type error in GitDownloader if branches cannot be listed (#10888)
• Fixed RootPackageInterface issue on PHP 5.3.3 (#10895)

[2.2.14] 2022-06-06

• Fixed handling of broken symlinks when checking whether a package is still installed (#6708)
• Fixed JSON schema regex pattern for name to be JS compatible (#10811)
• Fixed bin proxies to allow a proxy to include another one safely (#10823)

... (truncated)

Commits

• 978198b Release 2.2.21
• 45cef89 Update changelog
• 57b4730 Added optional plugin check in PluginInstaller (#11326)
• 5e5aaf7 Reverting release version changes
• b485082 Release 2.2.20
• 6e74b00 Update changelog
• 2a8efc7 Add extra.plugin-optional to auto-disable plugins in non-interactive mode (#1...
• 67f5892 Reverting release version changes
• 30ff21a Release 2.2.19
• 02c9a3b Update changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.