Refactor: Replace jean85/pretty-package-versions with native Composer\InstalledVersions

[peter17]

Summary

Now that Composer 2 is standard across the ecosystem, Composer\InstalledVersions (provided natively via composer-runtime-api ^2.0) is available out of the box.

This PR removes our dependency on jean85/pretty-package-versions and updates ModulesIntegration.php to call Composer\InstalledVersions::getPrettyVersion() directly.

Rationale

• Native Runtime API: Composer 2 provides Composer\InstalledVersions natively, making third-party helper wrappers unnecessary for Composer 2+ environments.
• Supply-Chain Security & Reduced Footprint: Preferring native APIs maintained directly by official project organizations (like Composer itself) helps minimize our overall dependency footprint and reduces potential supply-chain
  attack surface.
• Huge thanks to jean85 for maintaining pretty-package-versions over the years—it served the community fantastically through the Composer 1 era!

Changes

• In composer.json: Replaced jean85/pretty-package-versions with "composer-runtime-api": "^2.0".
• In ModulesIntegration: Switched version resolution to InstalledVersions::getPrettyVersion($package) and removed Composer 1 legacy fallback logic.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 184acee. Configure here.}

[cursor]

Dev versions lose commit identity

Medium Severity

PrettyVersions::getVersion()->getPrettyVersion() is not equivalent to InstalledVersions::getPrettyVersion(). For non-tagged installs, the former appended a short commit reference, while Composer’s API returns only the branch/pretty string. Module data on Sentry events can no longer identify the exact revision for branch or VCS packages.

 

^{Reviewed by Cursor Bugbot for commit 184acee. Configure here.}

[peter17]

If this is really an issue, would something like this be acceptable?

$prettyVersion = InstalledVersions::getPrettyVersion($package);
if ($prettyVersion !== null) {
    $reference = InstalledVersions::getReference($package);
    if ($reference !== null && str_starts_with($prettyVersion, 'dev-')) {
        $prettyVersion .= '@' . substr($reference, 0, 7);
    }
    self::$packages[$package] = $prettyVersion;
}