Announcement: Dependabot no longer supports Composer v1

[jonjanego]

As of November 6, 2024, Dependabot no longer supports Composer version 1, which has reached its end-of-life. If you continue to use Composer version 1, Dependabot will be unable to create pull requests to update your dependencies. If this affects you, we recommend updating to a supported release of Composer. As of November 2024, the newest supported version of Composer is 2.8, and the long-term supported version is 2.2.

View Composer's official documentation for more information about supported releases.

---

Here's some additional information to help you understand potential error messages you may see from Dependabot now v1 of Composer is unsupported, what actions you can take, and how Dependabot will behave.

Case 1: Composer Version is v1

• Action Required: Upgrade your Composer to v2.
  • If all dependencies are compatible with Composer v2, the update will proceed successfully.
  • If any dependencies are incompatible, you may encounter the following error:
    • Error Message: "Dependabot can't resolve your PHP dependency files"

Case 2: Composer Version Not Specified in composer.lock

• Action Required: Ensure your project is compatible with Composer v2.
  • If all dependencies are compatible with Composer v2, the update will succeed.
  • If any dependencies are incompatible, you may encounter the following error:
    • Error Message: "Dependabot can't resolve your PHP dependency files"

Case 3: No Composer Version Present (No composer.lock)

• No Action Required: Dependabot will continue running as expected, and Composer v2 will be used by default.

Case 4: Composer Version is v2

• No Action Required: Dependabot will continue to function as expected using Composer v2.