How to use Composer 2 in PHP applications

[jonaskroeger]

Goal

With the release of Composer 2, you might want to use it in your PHP application.

Assumptions

You already have a Platform.sh project set up and a .platform.app.yaml that is configured accordingly for PHP.

Problems

Platform.sh PHP images ship with Composer 1.

Steps

Since you can declare additional dependencies via your .platform.app.yaml, Composer 2 can be required like this:

dependencies:
    php:
        composer/composer: '^2.0'

Conclusion

After you commit and push your changes, with the next build and redeploy, the application container will get Composer 2 (both during build and runtime):

web@app.0:~$ composer --version
Composer 2.0.2 2020-10-25 23:03:59

[adamp7s1p4]

The build phase still uses composer 1:

dependencies:
    php:
        'composer/composer': '^2.0.7'
        'drush/drush': '^10.3.6'

build:
    flavor: composer

The build log still says:

  Installing build dependencies...
    Installing php build dependencies: composer/composer, drush/drush
    W: Changed current directory to /app/.global
    W: Loading composer repositories with package information
    W: Warning from https://repo.packagist.org: You are using an outdated version of Composer. Composer 2.0 is now available and you should upgrade. See https://getcomposer.org/2
    W: Updating dependencies (including require-dev)
    W: Package operations: 53 installs, 0 updates, 0 removals

[aloys-dillar]

Indeed as of the date of writing of this answer, the flavor provided is still on composer 1 (that may change in the future).

That means that when composer is installing composer 2 it will display the You are using an outdated version of Composer warning.
Subsequent installs in the hooks should use composer 2.

Important to note is also that not all plugins are (yet) compatible with composer 2.

A symptom for that incompatible plugins can also be when the following message is displayed:

   W: Warning from https://repo.packagist.org: You are using an outdated version of Composer. Composer 2.0 is now available and you should upgrade. See https://getcomposer.org/2

With an incompatible plugin, composer 2 will fallback to composer 1.

To verify if it’s indeed a specific plugin that does cause that message to be displayed, run grep '"composer/composer":' composer.lock :
If the output doesn’t include composer ^2.0.0, as in the 3rd line of the following output, then the linked plugin probably needs an update.

   "composer/composer": "~1.0 || ~2.0",
                "composer/composer": "^1.0 || ^2.0",
                "composer/composer": ">=1.2.0 <1.7.0 || ^1.7.1",
                "composer/composer": ">=1.5.6 <1.7.0 || ^1.7.1 || ^2.0.0",

More information regarding the “caret version range operator” can be found in composer’s documentation below:
https://getcomposer.org/doc/articles/versions.md#caret-version-range-