Adobe Commerce Deployments Failing - Composer block-insecure in Effect for 2.7/2.8
If you’re running into this issue with Adobe Commerce deployments, it’s due to the older versions of composer now being marked as having a few security issues (“PKSA-1gck-s111-yq7g”, “PKSA-b8f7-zn44-r4gz”, “PKSA-s25b-vbmp-jvhh”):
Installing build dependencies...
Installing php build dependencies: composer/composer
W: Changed current directory to /app/.global/composer/composer
W: No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
W: Loading composer repositories with package information
W: Updating dependencies
W: Your requirements could not be resolved to an installable set of packages.
W:
W: Problem 1
W: - Root composer.json requires composer/composer 2.7.0 (exact version match: 2.7.0 or 2.7.0.0), found composer/composer[2.7.0] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-1gck-s111-yq7g", "PKSA-b8f7-zn44-r4gz", "PKSA-s25b-vbmp-jvhh") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
W:
E: Error building project: `composer` could not be run.
E: Error: Unable to build application, aborting.To fix the issue, update the version of composer used to build your project in the .magento.app.yaml file:
dependencies:
php:
composer/composer: '^2.9'