fix composer merge plugin

[tarrow]

This patch fixes some unusual behaviour of the composer-merge-plugin that prevents it from installing using the composer.lock file precisely.

Previously we worked around this by installing composer in a standalone environment to prevent it running composer update. Unfortunately this was broken by the new allow-plugins concept and worked around in #489 but this also prevented the install of packages from composer-merge-plugin.

[deer-wmde]

seems like this fixes it! 🎉

[deer-wmde]

So after our chat today I think we want to merge this right?

fwiw I tried running ./sync.sh -u on main and it also runs into the error, so I think we need this

[tarrow]

a) I'm worried how understandable what is going on is: is there a way to make this clearer?
b) does this accidentally reintroduce T302558 ? Can we test and be sure this isn't the case? I'm pretty certain that it's fixed back to what we learned 4 years ago but it would be nice to have some testing or something more concrete to check

[tarrow]

a) I'm worried how understandable what is going on is: is there a way to make this clearer? b) does this accidentally reintroduce T302558 ? Can we test and be sure this isn't the case? I'm pretty certain that it's fixed back to what we learned 4 years ago but it would be nice to have some testing or something more concrete to check

I have tried to make this much clearer and add links to the upstream solutions that are still out there cooking