Issue #3249550 by yash.rode, narendraR: Create a validator to ensure core was...

  project_browser.fixture_helper:

    class: Drupal\project_browser\ProjectBrowserFixtureHelper

    arguments: ['@database', '@state', '@http_client']

  project_browser.composer_validator.core_not_updated:

    class: Drupal\project_browser\ComposerInstaller\Validator\CoreNotUpdatedValidator

    arguments:

      - '@string_translation'

    tags:

      - { name: 'event_subscriber' }

  cache.project_browser:

    class: Drupal\Core\Cache\CacheBackendInterface

    tags:

<?php

namespace Drupal\project_browser\ComposerInstaller\Validator;

use Drupal\Core\StringTranslation\StringTranslationTrait;

use Drupal\Core\StringTranslation\TranslationInterface;

use Drupal\package_manager\Event\PreApplyEvent;

use Drupal\project_browser\ComposerInstaller\Installer;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;

/**

 * Validates that Drupal core was not updated during project install.

 *

 * @internal

 *   Tagged services are internal.

 */

final class CoreNotUpdatedValidator implements EventSubscriberInterface {

  use StringTranslationTrait;

  /**

   * Constructs a CoreNotUpdatedValidator object.

   *

   * @param \Drupal\Core\StringTranslation\TranslationInterface $translation

   *   The translation service.

   */

  public function __construct(TranslationInterface $translation) {

    $this->setStringTranslation($translation);

  }

  /**

   * Validates Drupal core was not updated during project install.

   *

   * @param \Drupal\package_manager\Event\PreApplyEvent $event

   *   The event object.

   */

  public function validateCoreNotUpdated(PreApplyEvent $event): void {

    $stage = $event->getStage();

    if (!$stage instanceof Installer) {

      return;

    }

    $staged = $stage->getStageComposer();

    $active = $stage->getActiveComposer();

    $updated_packages = $staged->getPackagesWithDifferentVersionsIn($active);

    if (array_key_exists('drupal/core', $updated_packages)) {

      $event->addError([

        $this->t('Drupal core has been updated in the staging area, which is not allowed by Project Browser.'),

      ]);

    }

  }

  /**

   * {@inheritdoc}

   */

  public static function getSubscribedEvents() {

    return [

      PreApplyEvent::class => 'validateCoreNotUpdated',

    ];

  }

}

{

    "packages": [

        {

            "name": "drupal/core-recommended",

            "version": "9.8.0",

            "require": {

                "drupal/core": "9.8.0"

            }

        },

        {

            "name": "drupal/core",

            "version": "9.8.0"

        }

    ]

}

{

    "packages": [

        {

            "name": "drupal/core-recommended",

            "version": "9.8.0",

            "require": {

                "drupal/core": "9.8.0"

            }

        },

        {

            "name": "drupal/core",

            "version": "9.8.0"

        }

    ]

}

{

    "packages": [

        {

            "name": "drupal/core-recommended",

            "version": "9.8.1",

            "require": {

                "drupal/core": "9.8.1"

            }

        },

        {

            "name": "drupal/core",

            "version": "9.8.1"

        }

    ]

}