Merge branch 'main' into skipInvalidFormatFundingOnImport

.github/workflows/release.yml

@@ -15,6 +15,8 @@ jobs:
   build:
     permissions:
       contents: write # for actions/create-release to create a release
+      id-token: write # for actions/attest-build-provenance to create a attestation certificate
+      attestations: write # for actions/attest-build-provenance to upload the attestation
     name: Upload Release Asset
     runs-on: ubuntu-latest
     steps:
@@ -41,6 +43,11 @@ jobs:
       - name: Build phar file
         run: "php -d phar.readonly=0 bin/compile"
 
+      - name: Generate build provenance attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: '${{ github.workspace }}/composer.phar'
+
       - name: Create release
         id: create_release
         uses: actions/create-release@v1

composer.lock

@@ -8,16 +8,16 @@
     "packages": [
         {
             "name": "composer/ca-bundle",
-            "version": "1.5.4",
+            "version": "1.5.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/composer/ca-bundle.git",
-                "reference": "bc0593537a463e55cadf45fd938d23b75095b7e1"
+                "reference": "08c50d5ec4c6ced7d0271d2862dec8c1033283e6"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/composer/ca-bundle/zipball/bc0593537a463e55cadf45fd938d23b75095b7e1",
+                "url": "https://api.github.com/repos/composer/ca-bundle/zipball/08c50d5ec4c6ced7d0271d2862dec8c1033283e6",
-                "reference": "bc0593537a463e55cadf45fd938d23b75095b7e1",
+                "reference": "08c50d5ec4c6ced7d0271d2862dec8c1033283e6",
                 "shasum": ""
             },
             "require": {
@@ -64,7 +64,7 @@
             "support": {
                 "irc": "irc://irc.freenode.org/composer",
                 "issues": "https://github.com/composer/ca-bundle/issues",
-                "source": "https://github.com/composer/ca-bundle/tree/1.5.4"
+                "source": "https://github.com/composer/ca-bundle/tree/1.5.5"
             },
             "funding": [
                 {
@@ -80,7 +80,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2024-11-27T15:35:25+00:00"
+            "time": "2025-01-08T16:17:16+00:00"
         },
         {
             "name": "composer/class-map-generator",
@@ -251,13 +251,13 @@
             },
             "type": "library",
             "extra": {
-                "branch-alias": {
-                    "dev-main": "2.x-dev"
-                },
                 "phpstan": {
                     "includes": [
                         "extension.neon"
                     ]
+                },
+                "branch-alias": {
+                    "dev-main": "2.x-dev"
                 }
             },
             "autoload": {
@@ -1057,12 +1057,12 @@
             },
             "type": "library",
             "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/contracts",
+                    "name": "symfony/contracts"
+                },
                 "branch-alias": {
                     "dev-main": "2.5-dev"
-                },
-                "thanks": {
-                    "name": "symfony/contracts",
-                    "url": "https://github.com/symfony/contracts"
                 }
             },
             "autoload": {
@@ -1874,12 +1874,12 @@
             },
             "type": "library",
             "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/contracts",
+                    "name": "symfony/contracts"
+                },
                 "branch-alias": {
                     "dev-main": "2.5-dev"
-                },
-                "thanks": {
-                    "name": "symfony/contracts",
-                    "url": "https://github.com/symfony/contracts"
                 }
             },
             "autoload": {
@@ -2020,16 +2020,16 @@
     "packages-dev": [
         {
             "name": "phpstan/phpstan",
-            "version": "1.12.12",
+            "version": "1.12.15",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "b5ae1b88f471d3fd4ba1aa0046234b5ca3776dd0"
+                "reference": "c91d4e8bc056f46cf653656e6f71004b254574d1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/b5ae1b88f471d3fd4ba1aa0046234b5ca3776dd0",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/c91d4e8bc056f46cf653656e6f71004b254574d1",
-                "reference": "b5ae1b88f471d3fd4ba1aa0046234b5ca3776dd0",
+                "reference": "c91d4e8bc056f46cf653656e6f71004b254574d1",
                 "shasum": ""
             },
             "require": {
@@ -2074,7 +2074,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2024-11-28T22:13:23+00:00"
+            "time": "2025-01-05T16:40:22+00:00"
         },
         {
             "name": "phpstan/phpstan-deprecation-rules",
@@ -2125,16 +2125,16 @@
         },
         {
             "name": "phpstan/phpstan-phpunit",
-            "version": "1.4.1",
+            "version": "1.4.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan-phpunit.git",
-                "reference": "11d4235fbc6313ecbf93708606edfd3222e44949"
+                "reference": "72a6721c9b64b3e4c9db55abbc38f790b318267e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan-phpunit/zipball/11d4235fbc6313ecbf93708606edfd3222e44949",
+                "url": "https://api.github.com/repos/phpstan/phpstan-phpunit/zipball/72a6721c9b64b3e4c9db55abbc38f790b318267e",
-                "reference": "11d4235fbc6313ecbf93708606edfd3222e44949",
+                "reference": "72a6721c9b64b3e4c9db55abbc38f790b318267e",
                 "shasum": ""
             },
             "require": {
@@ -2171,9 +2171,9 @@
             "description": "PHPUnit extensions and rules for PHPStan",
             "support": {
                 "issues": "https://github.com/phpstan/phpstan-phpunit/issues",
-                "source": "https://github.com/phpstan/phpstan-phpunit/tree/1.4.1"
+                "source": "https://github.com/phpstan/phpstan-phpunit/tree/1.4.2"
             },
-            "time": "2024-11-12T12:43:59+00:00"
+            "time": "2024-12-17T17:20:49+00:00"
         },
         {
             "name": "phpstan/phpstan-strict-rules",
@@ -2226,16 +2226,16 @@
         },
         {
             "name": "phpstan/phpstan-symfony",
-            "version": "1.4.12",
+            "version": "1.4.13",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan-symfony.git",
-                "reference": "c7b7e7f520893621558bfbfdb2694d4364565c1d"
+                "reference": "dd1aaa7f85f9916222a2ce7e4d21072fe03958f4"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan-symfony/zipball/c7b7e7f520893621558bfbfdb2694d4364565c1d",
+                "url": "https://api.github.com/repos/phpstan/phpstan-symfony/zipball/dd1aaa7f85f9916222a2ce7e4d21072fe03958f4",
-                "reference": "c7b7e7f520893621558bfbfdb2694d4364565c1d",
+                "reference": "dd1aaa7f85f9916222a2ce7e4d21072fe03958f4",
                 "shasum": ""
             },
             "require": {
@@ -2292,9 +2292,9 @@
             "description": "Symfony Framework extensions and rules for PHPStan",
             "support": {
                 "issues": "https://github.com/phpstan/phpstan-symfony/issues",
-                "source": "https://github.com/phpstan/phpstan-symfony/tree/1.4.12"
+                "source": "https://github.com/phpstan/phpstan-symfony/tree/1.4.13"
             },
-            "time": "2024-11-06T10:13:18+00:00"
+            "time": "2025-01-04T13:55:31+00:00"
         },
         {
             "name": "symfony/phpunit-bridge",

doc/04-schema.md

@@ -151,7 +151,7 @@ Optional.
 
 Release date of the version.
 
-Must be in `YYYY-MM-DD` or `YYYY-MM-DD HH:MM:SS` format.
+Must be in `YYYY-MM-DD` or `YYYY-MM-DD HH:MM:SS` format in UTC timezone.
 
 Optional.
 

doc/faqs/how-to-install-composer-programmatically.md

@@ -35,7 +35,7 @@ give it uniqueness and authenticity as long as you can trust the GitHub servers.
 For example:
 
 ```shell
-wget https://raw.githubusercontent.com/composer/getcomposer.org/76a7060ccb93902cd7576b67264ad91c8a2700e2/web/installer -O - -q | php -- --quiet
+wget https://raw.githubusercontent.com/composer/getcomposer.org/f3108f64b4e1c1ce6eb462b159956461592b3e3e/web/installer -O - -q | php -- --quiet
 ```
 
 You may replace the commit hash by whatever the last commit hash is on

src/Composer/Autoload/AutoloadGenerator.php

@@ -578,12 +578,17 @@ EOF;
         }
         $sortedPackageMap = $this->sortPackageMap($packageMap);
         $sortedPackageMap[] = $rootPackageMap;
-        array_unshift($packageMap, $rootPackageMap);
+        $reverseSortedMap = array_reverse($sortedPackageMap);
 
-        $psr0 = $this->parseAutoloadsType($packageMap, 'psr-0', $rootPackage);
+        // reverse-sorted means root first, then dependents, then their dependents, etc.
-        $psr4 = $this->parseAutoloadsType($packageMap, 'psr-4', $rootPackage);
+        // which makes sense to allow root to override classmap or psr-0/4 entries with higher precedence rules
-        $classmap = $this->parseAutoloadsType(array_reverse($sortedPackageMap), 'classmap', $rootPackage);
+        $psr0 = $this->parseAutoloadsType($reverseSortedMap, 'psr-0', $rootPackage);
+        $psr4 = $this->parseAutoloadsType($reverseSortedMap, 'psr-4', $rootPackage);
+        $classmap = $this->parseAutoloadsType($reverseSortedMap, 'classmap', $rootPackage);
+
+        // sorted (i.e. dependents first) for files to ensure that dependencies are loaded/available once a file is included
         $files = $this->parseAutoloadsType($sortedPackageMap, 'files', $rootPackage);
+        // using sorted here but it does not really matter as all are excluded equally
         $exclude = $this->parseAutoloadsType($sortedPackageMap, 'exclude-from-classmap', $rootPackage);
 
         krsort($psr0);

src/Composer/Command/SelfUpdateCommand.php

@@ -23,6 +23,7 @@ use Composer\SelfUpdate\Versions;
 use Composer\IO\IOInterface;
 use Composer\Downloader\FilesystemException;
 use Composer\Downloader\TransportException;
+use Phar;
 use Symfony\Component\Console\Input\InputInterface;
 use Composer\Console\Input\InputOption;
 use Composer\Console\Input\InputArgument;
@@ -116,9 +117,9 @@ EOT
         $cacheDir = $config->get('cache-dir');
         $rollbackDir = $config->get('data-dir');
         $home = $config->get('home');
-        $localFilename = realpath($_SERVER['argv'][0]);
+        $localFilename = Phar::running(false);
-        if (false === $localFilename) {
+        if ('' === $localFilename) {
-            $localFilename = $_SERVER['argv'][0];
+            throw new \RuntimeException('Could not determine the location of the composer.phar file as it appears you are not running this code from a phar archive.');
         }
 
         if ($input->getOption('update-keys')) {

src/Composer/Repository/Vcs/GitHubDriver.php

@@ -257,36 +257,42 @@ class GitHubDriver extends VcsDriver
 
         foreach ($result as $key => $item) {
             switch ($item['type']) {
-                case 'tidelift':
+                case 'community_bridge':
-                    $result[$key]['url'] = 'https://tidelift.com/funding/github/' . $item['url'];
+                    $result[$key]['url'] = 'https://funding.communitybridge.org/projects/' . basename($item['url']);
                     break;
                 case 'github':
                     $result[$key]['url'] = 'https://github.com/' . basename($item['url']);
                     break;
-                case 'patreon':
+                case 'issuehunt':
-                    $result[$key]['url'] = 'https://www.patreon.com/' . basename($item['url']);
+                    $result[$key]['url'] = 'https://issuehunt.io/r/' . $item['url'];
-                    break;
-                case 'otechie':
-                    $result[$key]['url'] = 'https://otechie.com/' . basename($item['url']);
-                    break;
-                case 'open_collective':
-                    $result[$key]['url'] = 'https://opencollective.com/' . basename($item['url']);
-                    break;
-                case 'liberapay':
-                    $result[$key]['url'] = 'https://liberapay.com/' . basename($item['url']);
                     break;
                 case 'ko_fi':
                     $result[$key]['url'] = 'https://ko-fi.com/' . basename($item['url']);
                     break;
-                case 'issuehunt':
+                case 'liberapay':
-                    $result[$key]['url'] = 'https://issuehunt.io/r/' . $item['url'];
+                    $result[$key]['url'] = 'https://liberapay.com/' . basename($item['url']);
                     break;
-                case 'community_bridge':
+                case 'open_collective':
-                    $result[$key]['url'] = 'https://funding.communitybridge.org/projects/' . basename($item['url']);
+                    $result[$key]['url'] = 'https://opencollective.com/' . basename($item['url']);
+                    break;
+                case 'patreon':
+                    $result[$key]['url'] = 'https://www.patreon.com/' . basename($item['url']);
+                    break;
+                case 'tidelift':
+                    $result[$key]['url'] = 'https://tidelift.com/funding/github/' . $item['url'];
+                    break;
+                case 'polar':
+                    $result[$key]['url'] = 'https://polar.sh/' . basename($item['url']);
                     break;
                 case 'buy_me_a_coffee':
                     $result[$key]['url'] = 'https://www.buymeacoffee.com/' . basename($item['url']);
                     break;
+                case 'thanks_dev':
+                    $result[$key]['url'] = 'https://thanks.dev/' . basename($item['url']);
+                    break;
+                case 'otechie':
+                    $result[$key]['url'] = 'https://otechie.com/' . basename($item['url']);
+                    break;
                 case 'custom':
                     $bits = parse_url($item['url']);
                     if ($bits === false) {

src/Composer/Util/Http/CurlDownloader.php

@@ -426,7 +426,7 @@ class CurlDownloader
                 }
                 fclose($job['bodyHandle']);
 
-                if ($response->getStatusCode() >= 400 && $response->getHeader('content-type') === 'application/json') {
+                if ($response->getStatusCode() >= 300 && $response->getHeader('content-type') === 'application/json') {
                     HttpDownloader::outputWarnings($this->io, $job['origin'], json_decode($response->getBody(), true));
                 }
 

src/Composer/Util/RemoteFilesystem.php

@@ -304,7 +304,7 @@ class RemoteFilesystem
 
             if (!empty($http_response_header[0])) {
                 $statusCode = self::findStatusCode($http_response_header);
-                if ($statusCode >= 400 && Response::findHeaderValue($http_response_header, 'content-type') === 'application/json') {
+                if ($statusCode >= 300 && Response::findHeaderValue($http_response_header, 'content-type') === 'application/json') {
                     HttpDownloader::outputWarnings($this->io, $originUrl, json_decode($result, true));
                 }
 

src/Composer/Util/Tar.php

@@ -50,7 +50,7 @@ class Tar
         }
 
         $composerJsonPath = key($topLevelPaths).'/composer.json';
-        if ($topLevelPaths && isset($phar[$composerJsonPath])) {
+        if (\count($topLevelPaths) > 0 && isset($phar[$composerJsonPath])) {
             return $phar[$composerJsonPath]->getContent();
         }
 

tests/Composer/Test/AllFunctionalTest.php

@@ -96,6 +96,7 @@ class AllFunctionalTest extends TestCase
 
         self::assertFileExists(self::$pharPath);
         copy(self::$pharPath, __DIR__.'/../../composer-test.phar');
+        chmod(__DIR__.'/../../composer-test.phar', 0777);
     }
 
     /**

tests/Composer/Test/Command/SelfUpdateCommandTest.php

@@ -14,6 +14,7 @@ namespace Composer\Test\Command;
 
 use Composer\Composer;
 use Composer\Test\TestCase;
+use Symfony\Component\Process\Process;
 
 /**
  * @group slow
@@ -24,23 +25,15 @@ class SelfUpdateCommandTest extends TestCase
     /**
      * @var string
      */
-    private $prevArgv;
+    private $phar;
 
     public function setUp(): void
     {
         parent::setUp();
 
-        $this->prevArgv = $_SERVER['argv'][0];
         $dir = $this->initTempComposer();
         copy(__DIR__.'/../../../composer-test.phar', $dir.'/composer.phar');
-        $_SERVER['argv'][0] = $dir.'/composer.phar';
+        $this->phar = $dir.'/composer.phar';
-    }
-
-    public function tearDown(): void
-    {
-        parent::tearDown();
-
-        $_SERVER['argv'][0] = $this->prevArgv;
     }
 
     public function testSuccessfulUpdate(): void
@@ -49,20 +42,20 @@ class SelfUpdateCommandTest extends TestCase
             $this->markTestSkipped('On releases this test can fail to upgrade as we are already on latest version');
         }
 
-        $appTester = $this->getApplicationTester();
+        $appTester = new Process([PHP_BINARY, $this->phar, 'self-update']);
-        $appTester->run(['command' => 'self-update']);
+        $status = $appTester->run();
+        self::assertSame(0, $status, $appTester->getErrorOutput());
 
-        $appTester->assertCommandIsSuccessful();
+        self::assertStringContainsString('Upgrading to version', $appTester->getOutput());
-        self::assertStringContainsString('Upgrading to version', $appTester->getDisplay());
     }
 
     public function testUpdateToSpecificVersion(): void
     {
-        $appTester = $this->getApplicationTester();
+        $appTester = new Process([PHP_BINARY, $this->phar, 'self-update', '2.4.0']);
-        $appTester->run(['command' => 'self-update', 'version' => '2.4.0']);
+        $status = $appTester->run();
+        self::assertSame(0, $status, $appTester->getErrorOutput());
 
-        $appTester->assertCommandIsSuccessful();
+        self::assertStringContainsString('Upgrading to version 2.4.0', $appTester->getOutput());
-        self::assertStringContainsString('Upgrading to version 2.4.0', $appTester->getDisplay());
     }
 
     public function testUpdateWithInvalidOptionThrowsException(): void
@@ -83,12 +76,12 @@ class SelfUpdateCommandTest extends TestCase
             $this->markTestSkipped('On releases this test can fail to upgrade as we are already on latest version');
         }
 
-        $appTester = $this->getApplicationTester();
+        $appTester = new Process([PHP_BINARY, $this->phar, 'self-update', $option]);
-        $appTester->run(['command' => 'self-update', $option => true]);
+        $status = $appTester->run();
-        $appTester->assertCommandIsSuccessful();
+        self::assertSame(0, $status, $appTester->getErrorOutput());
 
-        self::assertStringContainsString('Upgrading to version', $appTester->getDisplay());
+        self::assertStringContainsString('Upgrading to version', $appTester->getOutput());
-        self::assertStringContainsString($expectedOutput, $appTester->getDisplay());
+        self::assertStringContainsString($expectedOutput, $appTester->getOutput());
     }
 
     /**