Dependabot-core: [composer] Support for COMPOSER_ROOT_VERSION

[localheinz]

When working with packages that depend on themselves, Dependabot currently cannot resolve dependencies.

For an example, see:

• https://github.com/sebastianbergmann/phpunit/issues/4152
• https://app.dependabot.com/accounts/sebastianbergmann/update-logs/27685096

In build environments that can be controlled by us, we can solve this problem by specifying a COMPOSER_ROOT_VERSION environment variable.

For related documentation, see:

• https://getcomposer.org/doc/03-cli.md#composer-root-version

For related code in composer/composer, see:

• https://github.com/composer/composer/search?q=COMPOSER_ROOT_VERSION

For an example where this problem is fixed on GitHub Actions, see:

• https://github.com/sebastianbergmann/phpunit/pull/4154

I have no idea how this could be solved on your side, but perhaps this is a scenario that could consider?

/cc @sebastianbergmann

[jurre]

Thanks @localheinz, maybe we could somehow let you configure this for the dependabot job. Currently we’re pretty swamped with integrating dependabot into github so it might be a while before we can get to this.

[localheinz]

@jurre

No problem! Thank you for getting back to me!

👍