Audit locked packages if update is called with --no-install, fixes #10894

src/Composer/Installer.php

@@ -388,19 +388,25 @@ class Installer
         }
 
         if ($this->audit) {
-            $packages = $localRepo->getCanonicalPackages();
+            if ($this->update && !$this->install) {
+                $packages = $lockedRepository->getCanonicalPackages();
+                $target = 'locked';
+            } else {
+                $packages = $localRepo->getCanonicalPackages();
+                $target = 'installed';
+            }
             if (count($packages) > 0) {
                 try {
                     $auditor = new Auditor(Factory::createHttpDownloader($this->io, $this->config));
                     $auditor->audit($this->io, $packages, $this->auditFormat);
                 } catch (TransportException $e) {
-                    $this->io->error('Failed to audit installed packages.');
+                    $this->io->error('Failed to audit '.$target.' packages.');
                     if ($this->io->isVerbose()) {
                         $this->io->error($e->getMessage());
                     }
                 }
             } else {
-                $this->io->writeError('No packages - skipping audit.');
+                $this->io->writeError('No '.$target.' packages - skipping audit.');
             }
         }
 

src/Composer/Repository/CanonicalPackagesTrait.php

@@ -0,0 +1,55 @@
+<?php declare(strict_types=1);
+
+/*
+ * This file is part of Composer.
+ *
+ * (c) Nils Adermann <naderman@naderman.de>
+ *     Jordi Boggiano <j.boggiano@seld.be>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Composer\Repository;
+
+use Composer\Package\AliasPackage;
+use Composer\Package\PackageInterface;
+
+/**
+ * Provides getCanonicalPackages() to various repository implementations
+ *
+ * @internal
+ */
+trait CanonicalPackagesTrait
+{
+    /**
+     * Get unique packages (at most one package of each name), with aliases resolved and removed.
+     *
+     * @return PackageInterface[]
+     */
+    public function getCanonicalPackages()
+    {
+        $packages = $this->getPackages();
+
+        // get at most one package of each name, preferring non-aliased ones
+        $packagesByName = array();
+        foreach ($packages as $package) {
+            if (!isset($packagesByName[$package->getName()]) || $packagesByName[$package->getName()] instanceof AliasPackage) {
+                $packagesByName[$package->getName()] = $package;
+            }
+        }
+
+        $canonicalPackages = array();
+
+        // unfold aliased packages
+        foreach ($packagesByName as $package) {
+            while ($package instanceof AliasPackage) {
+                $package = $package->getAliasOf();
+            }
+
+            $canonicalPackages[] = $package;
+        }
+
+        return $canonicalPackages;
+    }
+}

src/Composer/Repository/LockArrayRepository.php

@@ -21,6 +21,8 @@ namespace Composer\Repository;
  */
 class LockArrayRepository extends ArrayRepository
 {
+    use CanonicalPackagesTrait;
+
     public function getRepoName(): string
     {
         return 'lock repo';

src/Composer/Repository/WritableArrayRepository.php

@@ -22,6 +22,8 @@ use Composer\Installer\InstallationManager;
  */
 class WritableArrayRepository extends ArrayRepository implements WritableRepositoryInterface
 {
+    use CanonicalPackagesTrait;
+
     /**
      * @var string[]
      */
@@ -69,33 +71,4 @@ class WritableArrayRepository extends ArrayRepository implements WritableReposit
     {
         $this->devMode = null;
     }
-
-    /**
-     * @inheritDoc
-     */
-    public function getCanonicalPackages()
-    {
-        $packages = $this->getPackages();
-
-        // get at most one package of each name, preferring non-aliased ones
-        $packagesByName = array();
-        foreach ($packages as $package) {
-            if (!isset($packagesByName[$package->getName()]) || $packagesByName[$package->getName()] instanceof AliasPackage) {
-                $packagesByName[$package->getName()] = $package;
-            }
-        }
-
-        $canonicalPackages = array();
-
-        // unfold aliased packages
-        foreach ($packagesByName as $package) {
-            while ($package instanceof AliasPackage) {
-                $package = $package->getAliasOf();
-            }
-
-            $canonicalPackages[] = $package;
-        }
-
-        return $canonicalPackages;
-    }
 }