[BUG] Composer constraints cause mirror integrity checks to fail

[rhoerr]

🐛 Bug report

Current Behavior

See https://github.com/mage-os/generate-mirror-repo-js/actions/runs/30324442184

Recent versions of Magento fail to install because they specify composer 2.9 in the matrix (I think), and all such versions are now insecure. This might be an issue for the generate repo, but I'm starting it here.

Expected Behavior

Successful install of 2.4.9 for mirror integrity checks

Minimal reproduction of the problem with instructions

What is the motivation / use case for changing the behavior?

Environment

Magento version: X.Y.Z 
PHP Version version: X.Y.Z 


Others:

[marcelmtz]

Root cause is Composer's audit.block-insecure (default true since 2.9), not the mirror.

Three advisories published 2026-07-20 (CVE-2026-59946/59947/59948) affect composer/composer <2.2.29 and >=2.3.0 <2.10.2. Upstream only backported to the 2.2 LTS and 2.10 branches, so no patched 2.9.x exists. Our matrix pins the binary to 2.9.8 for 2.4.7+, and generate-mirror-repo-js pins the library to match (composer/composer:~2.9.0), so the solve is unsatisfiable — hence exactly the 18 jobs on 2.9.8 failing while the 2.2.28 ones pass. COMPOSER_NO_AUDIT=1 doesn't help; it only skips the post-install audit, not the pool filter.

#386 bumps the matrix to 2.10.2. Verified against mirror.mage-os.org with 2.4.9: fails on 2.9.8, resolves cleanly on 2.10.2 with no other dependency blocked.