>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #2745245. --> Reported by: [Mixologic](https://www.drupal.org/user/391689) >>> <p>When processing new releases, the current code immediately deletes the old provider and provider include files. This can lead to a race condition where if composer requests a provider include file which contains the sha256 urls to all of the projects.</p>