From c7f32820d766fd81e73864ab6e969f5dd038820a Mon Sep 17 00:00:00 2001
From: Conrad Lara <cmlara@cmlara.com>
Date: Fri, 13 Jan 2023 13:20:03 -0800
Subject: [PATCH] Allow v2 metadata target to provide security advisories
 without releases. (#11257)

---
 src/Composer/Repository/ComposerRepository.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/Composer/Repository/ComposerRepository.php b/src/Composer/Repository/ComposerRepository.php
index a3442720f..ea87e5c4b 100644
--- a/src/Composer/Repository/ComposerRepository.php
+++ b/src/Composer/Repository/ComposerRepository.php
@@ -1017,7 +1017,7 @@ class ComposerRepository extends ArrayRepository implements ConfigurableReposito
             $promises[] = $this->startCachedAsyncDownload($name, $realName)
                 ->then(function (array $spec) use (&$packages, &$namesFound, $realName, $constraint, $acceptableStabilities, $stabilityFlags, $alreadyLoaded): void {
                     [$response, $packagesSource] = $spec;
-                    if (null === $response) {
+                    if (null === $response || !isset($response['packages'][$realName])) {
                         return;
                     }
 
@@ -1092,7 +1092,7 @@ class ComposerRepository extends ArrayRepository implements ConfigurableReposito
                     $response = $contents;
                 }
 
-                if (!isset($response['packages'][$packageName])) {
+                if (!isset($response['packages'][$packageName]) && !isset($response['security-advisories'])) {
                     return [null, $packagesSource];
                 }