The abandoned flag in composer.lock and installed.json is only written
when a package gets updated, so composer audit never reported packages
that were abandoned after that.
The audit command now loads the audited versions from the repositories,
first repository with the package name wins, and syncs the abandoned
state and replacement from there. This is skipped with
--abandoned=ignore and unreachable repositories are skipped with
--ignore-unreachable like for advisories.
the config docs said --json and --merge only apply to extra.*, but they also work for policy.*.ignore, policy.advisories.ignore-id and audit.ignore[-abandoned] (plus --json for policy.ignore-unreachable), where --merge does not need --json. listed the supported keys in the docs and option help, and noted the flags are ignored for other keys.
Closes#11873
dualfroz
upstream