Packagist badge cannot handle composer v2-only packages

[SteveDesmond-ca]

Are you experiencing an issue with...

shields.io

🐞 Description

Packagist (the PHP dependency management SaaS) deprecated their v1 API some time ago, so new packages are only being added to their v2 API.

The shields site uses v1 of the API, so it is not able to retrieve version numbers for newer packages.

🔗 Link to the badge

New package, not working:

Old package, works fine:

💡 Possible Solution

There are a couple possible options:

1. update BasePackagistService.fetch() to use the new API and modify transform() accordingly
2. update PackagistVersion.handle() to fallback to the JSON API

I would think the first would be preferrable, from a future maintenance perspective, so I'll get a PR ready for that tomorrow.

[SteveDesmond-ca]

I started diving in already, it looks like the v2 API has some pretty gnarly breaking changes so maybe holding off to have a discussion on the best way forward is better...

[chris48s]

If you're interested in working on this, have a look over #6508

Nobody has done anything on it for a while and but from memory there was not too much work left to do after the last round of comments to get it landed. Unfortunately the original author stopped responding (tbh it is one of those PRs that seemed simple but turned into a bit of a can of worms).

What's there is probably a pretty decent starting point if you wanted to try and get it over the line.

[SteveDesmond-ca]

Logging in this morning, the deprecation warning has been removed from my package and it now shows up via the v1 API (and therefore shields.io badge, see OP) so from an end-user perspective, if newly-created packages just need to wait until the next day to show up, I don't think that's a huge deal, but I can see from a technical perspective why we wouldn't want to be using a deprecated endpoint.

[kdambekalns]

As explained on https://blog.packagist.com/deprecating-composer-1-support/

This means new packages and old unused packages will only be visible to Composer 2 until someone installs them, at which point they will become visible to Composer 1 as well (within 24h as this process happens on a nightly basis).

So, yeah, not that urgent. Just a bit confusing.