feat(packagist): Support for v2 protocol

[zharinov]

Changes

Context

• Closes: Default composer/packagist to use v2 datasource API #19495

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[zharinov]

Blocked by #20595

[zharinov]

The problem is that I can't test it on the real repository, however you can see the call to packagist.org is identical to what we do for v2 in general, once we have metadata-url.

[rarkins]

I had expected that we could remove the hardcoded logic for packagist.org because the new behavior would be to try v2 API first for all registries anyway. Can that be done, or have I misunderstood, or do you prefer to do it gradual?

[zharinov]

Well, I thought about query efficiency, but now I see it's not the case since we cache getRepositoryMeta() anyway

[rarkins]

1. Try v2 first
2. If it fails, and we can fall back, flag that both in memory as well as a longer term cache (e.g. 24 hours) so that at most we test v2 once per day per registryUrl

BTW it could also be written so that we "test" v2 first before doing an extra query, so that if there's 10 lookups at once then we don't get 10 failures/unnecessary queries

[zharinov]

I propose more straightforward yet potentially robust solution: always fetch metadata (/packages.json), cache it for 10 minutes and perform v2 queries when available, falling back to old methods otherwise.

[viceice]

otherwise LGTM

[renovate-release]

🎉 This PR is included in version 34.154.0 🎉

The release is available on:

• GitHub release
• 34.154.0

Your semantic-release bot 📦🚀