Version conflict between composer packages due to Craft using composer/composer 2.2

[roland-d]

Hello, I am running into some of a roadblock. I am building my own plugin for Craft and running into a version conflict of composer packages. In my plugin I want to include a composer package that requires psr/log 3 but Craft is locked to psr/log 1.

The reason for this is that in the Craft CMS composer.json the package composer/composer is locked to 2.2.19. In composer/composer version 2.3 they bumped the requirements up to version 3 for psr/log. That was 2 years ago.

Now Brandon stated in this comment that Craft is not moving forward due to breaking changes in 2.3 as stated here:
#12482 (comment)

No idea what these breaking changes are but what options do I have? Is Craft going to move forward and use composer/composer 2.3+ or somehow hack it together so I can use psr/log:3.0?

[brandonkelly]

It’s on my list to work through the breaking changes and get the built-in Composer version updated. I’ll try to find some time to look into it for 4.5.

[michaelrog]

Ran into this in #13441 as well.

As far as I can tell, that breaking issue with Composer only affects Craft's CP-based auto-update features (?). If you're using Composer on your own CLI, i.e. not via the CP, it seems like pinning the latest Composer version is safe. (At least, it has been for me.)

So @roland-d, as a stopgap solution — At your own peril — You could force-load a compatible Composer version in your project-level composer.json:

"require-dev": {
  "composer/composer": "2.5.8 as 2.2.19",
  "psr/log": "^3.0"
},

[roland-d]

That would be awesome, thank you.

[brandonkelly]

Craft 3.9.0 and 4.5.0 are both out now, with a solution for this. Craft now bundles a composer.phar file and uses that to perform Composer operations internally, which allowed us to loosen up the composer/composer constraint to ^2.2.19 (#13519).

We’ll be removing that dependency entirely in Craft 5; it’s only left around for backwards compatibility.