dualfroz
d4a3091c46
The abandoned flag in composer.lock and installed.json is only written when a package gets updated, so composer audit never reported packages that were abandoned after that. The audit command now loads the audited versions from the repositories, first repository with the package name wins, and syncs the abandoned state and replacement from there. This is skipped with --abandoned=ignore and unreachable repositories are skipped with --ignore-unreachable like for advisories.