Merge branch '1.10'

CHANGELOG.md

@@ -20,6 +20,15 @@
   * Fixed suggest output being very spammy, it now is only one line long and shows more rarely
   * Fixed conflict rules like e.g. >=5 from matching dev-master, as it is not normalized to 9999999-dev internally anymore
 
+### [1.10.2] 2020-04-09
+
+  * Added --1 flag to `self-update` command which can be added to automated self-update runs to make sure it won't automatically jump to 2.0 once that is released
+  * Fixed path repository symlinks being made relative when the repo url is defined as absolute paths
+  * Fixed potential issues when using "composer ..." in scripts and composer/composer was also required in the project
+  * Fixed 1.10.0 regression when downloading GitHub archives from non-API URLs
+  * Fixed handling of malformed info in fund command
+  * Fixed Symfony5 compatibility issues in a few commands
+
 ### [1.10.1] 2020-03-13
 
   * Fixed path repository warning on empty path when using wildcards
@@ -846,6 +855,7 @@
 
   * Initial release
 
+[1.10.2]: https://github.com/composer/composer/compare/1.10.1...1.10.2
 [1.10.1]: https://github.com/composer/composer/compare/1.10.0...1.10.1
 [1.10.0]: https://github.com/composer/composer/compare/1.10.0-RC...1.10.0
 [1.10.0-RC]: https://github.com/composer/composer/compare/1.9.3...1.10.0-RC

src/Composer/Command/SelfUpdateCommand.php

@@ -51,6 +51,8 @@ class SelfUpdateCommand extends BaseCommand
                 new InputOption('stable', null, InputOption::VALUE_NONE, 'Force an update to the stable channel'),
                 new InputOption('preview', null, InputOption::VALUE_NONE, 'Force an update to the preview channel'),
                 new InputOption('snapshot', null, InputOption::VALUE_NONE, 'Force an update to the snapshot channel'),
+                new InputOption('1', null, InputOption::VALUE_NONE, 'Force an update to the stable channel, but only use 1.x versions'),
+                new InputOption('2', null, InputOption::VALUE_NONE, 'Force an update to the stable channel, but only use 2.x versions'),
                 new InputOption('set-channel-only', null, InputOption::VALUE_NONE, 'Only store the channel as the default one and then exit'),
             ))
             ->setHelp(
@@ -82,9 +84,10 @@ EOT
         $versionsUtil = new Versions($config, $httpDownloader);
 
         // switch channel if requested
-        foreach (array('stable', 'preview', 'snapshot') as $channel) {
+        foreach (Versions::CHANNELS as $channel) {
             if ($input->getOption($channel)) {
                 $versionsUtil->setChannel($channel);
+                break;
             }
         }
 
@@ -123,9 +126,14 @@ EOT
         }
 
         $latest = $versionsUtil->getLatest();
+        $latestStable = $versionsUtil->getLatest('stable');
         $latestVersion = $latest['version'];
         $updateVersion = $input->getArgument('version') ?: $latestVersion;
 
+        if (is_numeric($channel) && substr($latestStable['version'], 0, 1) !== $channel) {
+            $io->writeError('<warning>Warning: You forced the install of '.$latestVersion.' via --'.$channel.', but '.$latestStable['version'].' is the latest stable version. Updating to it via composer self-update --stable is recommended.</warning>');
+        }
+
         if (preg_match('{^[0-9a-f]{40}$}', $updateVersion) && $updateVersion !== $latestVersion) {
             $io->writeError('<error>You can not update to a specific SHA-1 as those phars are not available for download</error>');
 

src/Composer/EventDispatcher/EventDispatcher.php

@@ -535,7 +535,10 @@ class EventDispatcher
         if (is_dir($binDir)) {
             $binDir = realpath($binDir);
             if (isset($_SERVER[$pathStr]) && !preg_match('{(^|'.PATH_SEPARATOR.')'.preg_quote($binDir).'($|'.PATH_SEPARATOR.')}', $_SERVER[$pathStr])) {
-                $_SERVER[$pathStr] = $binDir.PATH_SEPARATOR.getenv($pathStr);
+                // prepend the COMPOSER_BINARY dir to the path to make sure that scripts running "composer" will run the expected composer
+                // from current path resolution, even if bin-dir contains composer too because the project requires composer/composer
+                // see https://github.com/composer/composer/issues/8748
+                $_SERVER[$pathStr] = dirname(getenv('COMPOSER_BINARY')).PATH_SEPARATOR.$binDir.PATH_SEPARATOR.getenv($pathStr);
                 putenv($pathStr.'='.$_SERVER[$pathStr]);
             }
         }

src/Composer/SelfUpdate/Versions.php

@@ -21,6 +21,8 @@ use Composer\Json\JsonFile;
  */
 class Versions
 {
+    const CHANNELS = array('stable', 'preview', 'snapshot', '1', '2');
+
     private $httpDownloader;
     private $config;
     private $channel;
@@ -50,21 +52,21 @@ class Versions
 
     public function setChannel($channel)
     {
-        if (!in_array($channel, array('stable', 'preview', 'snapshot'), true)) {
+        if (!in_array($channel, self::CHANNELS, true)) {
-            throw new \InvalidArgumentException('Invalid channel '.$channel.', must be one of: stable, preview, snapshot');
+            throw new \InvalidArgumentException('Invalid channel '.$channel.', must be one of: ' . implode(', ', self::CHANNELS));
         }
 
         $channelFile = $this->config->get('home').'/update-channel';
         $this->channel = $channel;
-        file_put_contents($channelFile, $channel.PHP_EOL);
+        file_put_contents($channelFile, (is_numeric($channel) ? 'stable' : $channel).PHP_EOL);
     }
 
-    public function getLatest()
+    public function getLatest($channel = null)
     {
         $protocol = extension_loaded('openssl') ? 'https' : 'http';
         $versions = $this->httpDownloader->get($protocol . '://getcomposer.org/versions')->decodeJson();
 
-        foreach ($versions[$this->getChannel()] as $version) {
+        foreach ($versions[$channel ?: $this->getChannel()] as $version) {
             if ($version['min-php'] <= PHP_VERSION_ID) {
                 return $version;
             }

src/Composer/Util/AuthHelper.php

@@ -200,8 +200,11 @@ class AuthHelper
             if ($auth['password'] === 'bearer') {
                 $headers[] = 'Authorization: Bearer '.$auth['username'];
             } elseif ('github.com' === $origin && 'x-oauth-basic' === $auth['password']) {
+                // only add the access_token if it is actually a github API URL
+                if (preg_match('{^https?://api\.github\.com/}', $url)) {
                     $headers[] = 'Authorization: token '.$auth['username'];
                     $authenticationDisplayMessage = 'Using GitHub token authentication';
+                }
             } elseif (in_array($origin, $this->config->get('gitlab-domains'), true)) {
                 if ($auth['password'] === 'oauth2') {
                     $headers[] = 'Authorization: Bearer '.$auth['username'];