Support Composer v2 canonical settings

[adamj88]

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us what version of Renovate you run.

34.188

If you're self-hosting Renovate, select which platform you are using.

gitlab.com

If you're self-hosting Renovate, tell us what version of the platform you run.

No response

Was this something which used to work for you, and then stopped?

I never saw this working

Describe the bug

The Packagist data source currently uses a registryStrategy of hunt as defined here:

renovate/lib/modules/datasource/packagist/index.ts

Line 33 in 64fee7e

override readonly registryStrategy = 'hunt';

This searches registryUrls in order and then chooses the first matching registry selecting the relevant version to install, however, this is contrary to how Composer 2 handles its repositories priorities as detailed here: https://getcomposer.org/doc/articles/repository-priorities.md

In Composer 2 with the canonical options, it would be more saying, for repositories (registries) marked canonical true (which is the default) then use the hunt strategy maintaining their order, but if the package is not found in those then scan the canonical false with the merge strategy.

An example can be seen when searching for the facebook/facebook-for-magento2 package with the following configuration in composer.json (note: auth tokens required for repo.magento.com):

"repositories": [
  {
    "type": "composer",
    "url": "https://repo.magento.com/",
    "canonical": false
  }
]

Where we have the following packages available:

• 1.4.4 on repo.magento.com
• 1.4.6 on packagist.org

In the debug output in the logs below 1.4.4 is returned from repo.magento.com where as installing with composer would yield 1.4.6 from packagist.org.

A previous discussion for this issue can be found here: #20181

Relevant debug logs

Logs

{
 "depType": "require",
 "depName": "facebook/facebook-for-magento2",
 "currentValue": "^1.4.4",
 "datasource": "packagist",
 "registryUrls": [
   "https://repo.magento.com/",
   "https://packagist.org"
 ],
 "depIndex": 9,
 "updates": [
   {
     "updateType": "pin",
     "isPin": true,
     "newValue": "1.4.4",
     "newVersion": "1.4.4",
     "newMajor": 1,
     "branchName": "renovate/pin-dependencies"
   }
 ],
 "warnings": [],
 "versioning": "composer",
 "registryUrl": "https://repo.magento.com",
 "currentVersion": "1.4.4"
}

Have you created a minimal reproduction repository?

Please see: https://github.com/adamj88/renovate-issue-20201

[github-actions]

Hi there,

Get your issue fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this.

To get started, please read our guide on creating a minimal reproduction.

We may close the issue if you, or someone else, haven't created a minimal reproduction within two weeks. If you need more time, or are stuck, please ask for help or more time in a comment.

Good luck,

The Renovate team

[rarkins]

It seems we'll need to make registryStrategy configurable (at least internally)

[adamj88]

I have created a minimal reproduction repository here: https://github.com/adamj88/renovate-issue-20201

[rarkins]

Reproduction forked to https://github.com/renovate-reproductions/20201