So, apparently, one must not update composer, since it'd break buildComposerProject2 because of: #451148 (comment)

After a quick glance at buildComposerProject, this doesn't seem affected. To me, this makes buildComposerProject2 the significantly inferior implementation.

The question for @nixos/php is now to discuss, how to move forward?

• Reconsider the deprecation of buildComposerProject (honestly, we have an inherently non-reproducible builder, I don't really see how this is better?)
• Implement some kind of check whether the generated files will change and recreate all FOD hashes (this should be happening automatically and with a check if nothing else has changed).