Hi!

Pretty sure we stumbled on a bug where if (A) symfony/flex is being upgraded AND (B) a new package is being installed that has a recipe, the recipe will be ignored.

We're seeing this when upgrading apps using certain UX packages, as a composer update grabs the new symfony/flex version AND installs symfony/stimulus-bundle, which is a new dependency for some UX packages.

Reproducer:

git clone git@github.com:weaverryan/flex-recipe-upgrade-bug.git
cd flex-recipe-upgrade-bug
composer update

You'll notice that it installs symfony/stimulus-bundle, but skips installing its recipe. Running composer update a 2nd time causes it to be installed.

Cause

This appears to be due to Composer being smart. When a plugin is upgraded, it's PluginManager::update() method unloads the old plugin, and loads the new one. The install of StimulusBundle is recorded into a Flex instance... but then that Flex instance is discarded and a new instance is created that is not aware of what packages were just installed.

Solution

Possibly, in Flex::deactivate(), we could... store $this->operations onto a static Flex property - e.g. public static $storedOperations. Then in Flex::activate(), we could look for Symfony\Flex\Flex::$storedOperations and use that (after the update, Composer uses a class called Symfony\Flex\Flex_composer_tmp0... so I'm assuming that Symfony\Flex\Flex would still be available, and we could look directly for it.

Cheers!