package_manager/src/ComposerInspector.php

@@ -315,15 +315,35 @@ class ComposerInspector implements LoggerAwareInterface {
     foreach ($packages_data as $name => $package) {
       $path = $package['path'];
 
+      // For packages installed as dev snapshots from certain version control
+      // systems, `composer show` displays the version like `1.0.x-dev 0a1b2c`,
+      // which will cause an exception if we try to parse it as a legitimate
+      // semantic version. Since we don't need the abbreviated commit hash, just
+      // remove it.
+      if (str_contains($package['version'], '-dev ')) {
+        $packages_data[$name]['version'] = explode(' ', $package['version'], 2)[0];
+      }
+
       // We expect Composer to report that metapackages' install paths are the
       // same as the working directory, in which case InstalledPackage::$path
       // should be NULL. For all other package types, we consider it invalid
       // if the install path is the same as the working directory.
+      // @todo Remove this handling of metapackage paths when Composer 2.5.7 or
+      //   later is required, in https://drupal.org/i/3365133.
       if (isset($package['type']) && $package['type'] === 'metapackage') {
-        if ($path !== NULL) {
+        // TRICKY: until Composer 2.5.6, metapackages returned the current
+        // working directory instead of NULL.
+        // @see https://github.com/composer/composer/commit/3a48e393756e8b0387925aa327f45a30128b4556
+        $packages_data[$name]['path'] = NULL;
+        // @todo Remove the if-branch when the minimum Composer version is raised to >=2.5.6.
+        if (Semver::satisfies($this->getVersion(), '<2.5.6')) {
+          if ($path !== $working_dir) {
+            throw new \UnexpectedValueException("Metapackage '$name' is installed at unexpected path: '$path', expected '$working_dir'");
+          }
+        }
+        elseif ($path !== NULL) {
           throw new \UnexpectedValueException("Metapackage '$name' is installed at unexpected path: '$path', expected NULL");
         }
-        $packages_data[$name]['path'] = $path;
       }
       elseif ($path === $working_dir) {
         throw new \UnexpectedValueException("Package '$name' cannot be installed at path: '$path'");

package_manager/tests/src/Kernel/ComposerInspectorTest.php

@@ -417,6 +417,36 @@ class ComposerInspectorTest extends PackageManagerKernelTestBase {
     $this->assertSame($is_metapackage, is_null($list['test/package']->path));
   }
 
+  /**
+   * Tests that the commit hash of a dev snapshot package is ignored.
+   */
+  public function testPackageDevSnapshotCommitHashIsRemoved(): void {
+    $inspector = new class (
+      $this->container->get(ComposerProcessRunnerInterface::class),
+      $this->container->get(ComposerIsAvailableInterface::class),
+      $this->container->get(PathFactoryInterface::class),
+    ) extends ComposerInspector {
+
+      /**
+       * {@inheritdoc}
+       */
+      protected function show(string $working_dir): array {
+        return [
+          'test/package' => [
+            'name' => 'test/package',
+            'path' => __DIR__,
+            'version' => '1.0.x-dev 0a1b2c3d',
+          ],
+        ];
+      }
+
+    };
+    $project_root = $this->container->get(PathLocator::class)
+      ->getProjectRoot();
+    $list = $inspector->getInstalledPackagesList($project_root);
+    $this->assertSame('1.0.x-dev', $list['test/package']->version);
+  }
+
   /**
    * Data provider for ::testAllowedPlugins().
    *