The abandoned flag in composer.lock and installed.json is only written
when a package gets updated, so composer audit never reported packages
that were abandoned after that.
The audit command now loads the audited versions from the repositories,
first repository with the package name wins, and syncs the abandoned
state and replacement from there. This is skipped with
--abandoned=ignore and unreachable repositories are skipped with
--ignore-unreachable like for advisories.
dualfroz
upstream