Nothing drives the transfers while tick() is blocked, e.g. by a prompt
for credentials, so requests which are still connecting time out with
curl error 28. Since #12662 these are retried, but each retry counts
like any other, so a few prompts can use up all of them, and parallel
requests to a private host which timed out that way abort with
"Invalid credentials" once the first of them got credentials, as
AuthHelper only reuses those for a request which was not retried yet.
tick() now keeps track of how long it was blocked between two ticks,
and a request which spent most of its time in that gap is restarted
without counting towards maxRetries.
Fixes#12402
The abandoned flag in composer.lock and installed.json is only written
when a package gets updated, so composer audit never reported packages
that were abandoned after that.
The audit command now loads the audited versions from the repositories,
first repository with the package name wins, and syncs the abandoned
state and replacement from there. This is skipped with
--abandoned=ignore and unreachable repositories are skipped with
--ignore-unreachable like for advisories.
the config docs said --json and --merge only apply to extra.*, but they also work for policy.*.ignore, policy.advisories.ignore-id and audit.ignore[-abandoned] (plus --json for policy.ignore-unreachable), where --merge does not need --json. listed the supported keys in the docs and option help, and noted the flags are ignored for other keys.
Closes#11873
dualfroz
upstream