From 00824371bbf4e583ac30c369045876e603cb6a44 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Thu, 6 Nov 2025 21:17:19 +0100
Subject: [PATCH 01/40] build-support/php: improve PHP builder stability

---
 doc/release-notes/rl-2605.section.md          |  2 +-
 .../v2/hooks/composer-install-hook.sh         | 46 +++++++++++----
 .../builders/v2/hooks/composer-vendor-hook.sh | 56 +++++++++++--------
 .../builders/v2/hooks/php-script-utils.bash   |  2 +
 4 files changed, 69 insertions(+), 37 deletions(-)

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 3a3977ffb779..01f7347d7600 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -82,4 +82,4 @@
 
 ### Additions and Improvements {#sec-nixpkgs-release-26.05-lib-additions-improvements}
 
-- Create the first release note entry in this section!
+- The builder `php.buildComposerProject2` for PHP applications has been improved for better reliability and stability.
diff --git a/pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh b/pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh
index 4e3eba5f0785..19783d08fb1c 100644
--- a/pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh
+++ b/pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh
@@ -5,6 +5,16 @@ declare -g pname
 declare -g composerVendor
 declare -g -i composerStrictValidation="${composerStrictValidation:-0}"
 
+declare -g composerNoDev
+declare -g composerNoPlugins
+declare -g composerNoScripts
+
+declare -ga composerFlags=()
+
+[[ 1 == "${composerNoDev:-1}" ]] && composerFlags+=(--no-dev)
+[[ 1 == "${composerNoPlugins:-1}" ]] && composerFlags+=(--no-plugins)
+[[ 1 == "${composerNoScripts:-1}" ]] && composerFlags+=(--no-scripts)
+
 preConfigureHooks+=(composerInstallConfigureHook)
 preBuildHooks+=(composerInstallBuildHook)
 preCheckHooks+=(composerInstallCheckHook)
@@ -14,12 +24,12 @@ preInstallHooks+=(composerInstallInstallHook)
 source @phpScriptUtils@
 
 composerInstallConfigureHook() {
-  echo "Executing composerInstallConfigureHook"
+  echo "Running phase: composerInstallConfigureHook"
 
   setComposerRootVersion
 
   if [[ ! -e "${composerVendor}" ]]; then
-    echo "No local composer vendor found." >&2
+    echo -e "\e[31mERROR: The 'composerVendor' attribute is missing or invalid.\e[0m" >&2
     exit 1
   fi
 
@@ -35,27 +45,39 @@ composerInstallConfigureHook() {
 
   chmod +w composer.json
 
-  echo "Finished composerInstallConfigureHook"
+  echo "Finished phase: composerInstallConfigureHook"
 }
 
 composerInstallBuildHook() {
-  echo "Executing composerInstallBuildHook"
+  echo "Running phase: composerInstallBuildHook"
 
-  echo "Finished composerInstallBuildHook"
+  setComposerEnvVariables
+
+  echo -e "\e[32mRestoring Composer vendor directory to '${COMPOSER_VENDOR_DIR}'...\e[0m"
+  cp -r "${composerVendor}/${COMPOSER_VENDOR_DIR}" .
+  chmod -R +w "${COMPOSER_VENDOR_DIR}"
+
+  echo -e "\e[32mGenerating optimized autoloader and restoring 'bin' directory...\e[0m"
+  COMPOSER_DISABLE_NETWORK=1 composer \
+    "${composerFlags[@]}" \
+    --no-interaction \
+    --no-progress \
+    --optimize-autoloader \
+    install
+
+  echo "Finished phase: composerInstallBuildHook"
 }
 
 composerInstallCheckHook() {
-  echo "Executing composerInstallCheckHook"
+  echo "Running phase: composerInstallCheckHook"
 
   checkComposerValidate
 
-  echo "Finished composerInstallCheckHook"
+  echo "Finished phase: composerInstallCheckHook"
 }
 
 composerInstallInstallHook() {
-  echo "Executing composerInstallInstallHook"
-
-  cp -ar "${composerVendor}"/* .
+  echo "Running phase: composerInstallInstallHook"
 
   # Copy the relevant files only in the store.
   mkdir -p "$out"/share/php/"${pname}"
@@ -64,10 +86,10 @@ composerInstallInstallHook() {
   # Create symlinks for the binaries.
   mapfile -t BINS < <(jq -r -c 'try (.bin[] | select(test(".bat$")? | not) )' composer.json)
   for bin in "${BINS[@]}"; do
-    echo -e "\e[32mCreating symlink ${bin}...\e[0m"
+    echo -e "\e[32mInstalling binary: ${bin}\e[0m"
     mkdir -p "$out/bin"
     ln -s "$out/share/php/${pname}/${bin}" "$out/bin/$(basename "$bin")"
   done
 
-  echo "Finished composerInstallInstallHook"
+  echo "Finished phase: composerInstallInstallHook"
 }
diff --git a/pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh b/pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh
index 83dda99f33cd..f14a53778a90 100644
--- a/pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh
+++ b/pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh
@@ -10,9 +10,9 @@ declare -g composerNoPlugins
 declare -g composerNoScripts
 
 declare -ga composerFlags=()
-[[ -n "${composerNoDev-}" ]] && composerFlags+=(--no-dev)
-[[ -n "${composerNoPlugins-}" ]] && composerFlags+=(--no-plugins)
-[[ -n "${composerNoScripts-}" ]] && composerFlags+=(--no-scripts)
+[[ 1 == "${composerNoDev:-1}" ]] && composerFlags+=(--no-dev)
+[[ 1 == "${composerNoPlugins:-1}" ]] && composerFlags+=(--no-plugins)
+[[ 1 == "${composerNoScripts:-1}" ]] && composerFlags+=(--no-scripts)
 
 preConfigureHooks+=(composerVendorConfigureHook)
 preBuildHooks+=(composerVendorBuildHook)
@@ -20,20 +20,21 @@ preCheckHooks+=(composerVendorCheckHook)
 preInstallHooks+=(composerVendorInstallHook)
 
 composerVendorConfigureHook() {
-  echo "Executing composerVendorConfigureHook"
+  echo "Running phase: composerVendorConfigureHook"
 
   setComposerRootVersion
 
   if [[ -f "composer.lock" ]]; then
-    echo -e "\e[32mUsing \`composer.lock\` file from the source package\e[0m"
+    echo -e "\e[32mFound 'composer.lock' in source root.\e[0m"
   fi
 
   if [[ -e "$composerLock" ]]; then
-    echo -e "\e[32mUsing user provided \`composer.lock\` file from \`$composerLock\`\e[0m"
+    echo -e "\e[32mUsing provided 'composer.lock' from: $composerLock\e[0m"
     install -Dm644 "$composerLock" ./composer.lock
   fi
 
   if [[ ! -f "composer.lock" ]]; then
+    echo "No 'composer.lock' found. Updating dependencies to generate one..."
     composer \
       --no-cache \
       --no-install \
@@ -47,16 +48,17 @@ composerVendorConfigureHook() {
       install -Dm644 composer.lock -t "$out"/
 
       echo
-      echo -e "\e[31mERROR: No composer.lock found\e[0m"
+      echo -e "\e[31mERROR: Missing 'composer.lock' file.\e[0m"
       echo
-      echo -e '\e[31mNo composer.lock file found, consider adding one to your repository to ensure reproducible builds.\e[0m'
-      echo -e "\e[31mIn the meantime, a composer.lock file has been generated for you in $out/composer.lock\e[0m"
+      echo -e "\e[31mA 'composer.lock' file is required to ensure reproducible builds, but it was not found in the source.\e[0m"
+      echo -e "\e[31mA temporary lock file has been generated for you at:\e[0m"
+      echo -e "\e[31m  $out/composer.lock\e[0m"
       echo
-      echo -e '\e[31mTo fix the issue:\e[0m'
-      echo -e "\e[31m1. Copy the composer.lock file from $out/composer.lock to the project's source:\e[0m"
-      echo -e "\e[31m  cp $out/composer.lock <path>\e[0m"
-      echo -e '\e[31m2. Add the composerLock attribute, pointing to the copied composer.lock file:\e[0m'
-      echo -e '\e[31m  composerLock = ./composer.lock;\e[0m'
+      echo -e "\e[31mTo fix this issue:\e[0m"
+      echo -e "\e[31m1. Copy the generated lock file to your project source:\e[0m"
+      echo -e "\e[31m     cp $out/composer.lock <path/to/project_root>/\e[0m"
+      echo -e "\e[31m2. Register the lock file in your Nix expression:\e[0m"
+      echo -e "\e[31m     composerLock = ./composer.lock;\e[0m"
       echo
 
       exit 1
@@ -69,39 +71,45 @@ composerVendorConfigureHook() {
 
   chmod +w composer.json
 
-  echo "Finished composerVendorConfigureHook"
+  echo "Finished phase: composerVendorConfigureHook"
 }
 
 composerVendorBuildHook() {
-  echo "Executing composerVendorBuildHook"
+  echo "Running phase: composerVendorBuildHook"
 
   setComposerEnvVariables
 
+  echo -e "\e[32mInstalling Composer dependencies to '${COMPOSER_VENDOR_DIR}'...\e[0m"
   composer \
     --no-cache \
     --no-interaction \
     --no-progress \
-    --optimize-autoloader \
+    --no-autoloader \
     "${composerFlags[@]}" \
     install
 
-  echo "Finished composerVendorBuildHook"
+  # Clarified: We remove it because we only want the 'vendor' folder here, not the bins yet.
+  echo -e "\e[32mCleaning up Composer 'bin' directory (will be regenerated during install).\e[0m"
+  rm -rf "$(composer config bin-dir)"
+
+  echo "Finished phase: composerVendorBuildHook"
 }
 
 composerVendorCheckHook() {
-  echo "Executing composerVendorCheckHook"
+  echo "Running phase: composerVendorCheckHook"
 
   checkComposerValidate
 
-  echo "Finished composerVendorCheckHook"
+  echo "Finished phase: composerVendorCheckHook"
 }
 
 composerVendorInstallHook() {
-  echo "Executing composerVendorInstallHook"
+  echo "Running phase: composerVendorInstallHook"
 
   mkdir -p "$out"
 
-  cp -ar composer.json "$(composer config vendor-dir)" "$out"/
+  echo -e "\e[32mPreserving Composer vendor directory from '${COMPOSER_VENDOR_DIR}'...\e[0m"
+  cp -ar composer.json "${COMPOSER_VENDOR_DIR}" "$out"/
   mapfile -t installer_paths < <(jq -r -c 'try((.extra."installer-paths") | keys[])' composer.json)
 
   for installer_path in "${installer_paths[@]}"; do
@@ -111,7 +119,7 @@ composerVendorInstallHook() {
     # Copy the installer path if it exists
     if [[ -d "$installer_path" ]]; then
       mkdir -p "$(dirname "$out_installer_path")"
-      echo -e "\e[32mCopying installer path $installer_path to $out_installer_path\e[0m"
+      echo -e "\e[32mPreserving custom installer path: $installer_path\e[0m"
       cp -ar "$installer_path" "$out_installer_path"
       # Strip out the git repositories
       find "$out_installer_path" -name .git -type d -prune -print -exec rm -rf {} ";"
@@ -122,5 +130,5 @@ composerVendorInstallHook() {
     cp -ar composer.lock "$out"/
   fi
 
-  echo "Finished composerVendorInstallHook"
+  echo "Finished phase: composerVendorInstallHook"
 }
diff --git a/pkgs/build-support/php/builders/v2/hooks/php-script-utils.bash b/pkgs/build-support/php/builders/v2/hooks/php-script-utils.bash
index bec552bfaa46..83dce2e9715a 100644
--- a/pkgs/build-support/php/builders/v2/hooks/php-script-utils.bash
+++ b/pkgs/build-support/php/builders/v2/hooks/php-script-utils.bash
@@ -15,6 +15,8 @@ setComposerEnvVariables() {
   export COMPOSER_MIRROR_PATH_REPOS=1
   export COMPOSER_HTACCESS_PROTECT=0
   export COMPOSER_FUND=0
+  COMPOSER_VENDOR_DIR=$(composer config vendor-dir)
+  export COMPOSER_VENDOR_DIR
 }
 
 checkComposerValidate() {

From a39030e6a66f81cd94dd649a03a0bc210495c723 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:28:51 +0100
Subject: [PATCH 02/40] phpunit: update `vendorHash`

---
 pkgs/by-name/ph/phpunit/package.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/by-name/ph/phpunit/package.nix b/pkgs/by-name/ph/phpunit/package.nix
index 189aaeddfd0b..f8fc830fb3f6 100644
--- a/pkgs/by-name/ph/phpunit/package.nix
+++ b/pkgs/by-name/ph/phpunit/package.nix
@@ -3,8 +3,6 @@
   fetchFromGitHub,
   nix-update-script,
   php,
-  phpunit,
-  testers,
   versionCheckHook,
 }:
 
@@ -19,11 +17,10 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-asHHNHUBt4EO/vLQdc5JyffgUqgOeJSXSG+b5bL0IQk=";
   };
 
-  vendorHash = "sha256-VERFWkcjIepOZO2/bvJj51lfMjs/5e8srsd0kIAp7bI=";
+  vendorHash = "sha256-ypZLrCNNh/QUa5cvA6zuh3b/eyE0YMH0Diiet7cDveI=";
 
   passthru = {
     updateScript = nix-update-script { };
-    tests.version = testers.testVersion { package = phpunit; };
   };
 
   doInstallCheck = true;

From 8d5c6ffa960f27d131dbe1067346de45706c96b1 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:29:35 +0100
Subject: [PATCH 03/40] baikal: unbreak, fix `vendorHash`

---
 pkgs/by-name/ba/baikal/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ba/baikal/package.nix b/pkgs/by-name/ba/baikal/package.nix
index 08103ccf5225..68f6a16d9474 100644
--- a/pkgs/by-name/ba/baikal/package.nix
+++ b/pkgs/by-name/ba/baikal/package.nix
@@ -6,22 +6,22 @@
 php.buildComposerProject2 (finalAttrs: {
   pname = "baikal";
   version = "0.10.1";
+
   src = fetchFromGitHub {
     owner = "sabre-io";
     repo = "Baikal";
     tag = finalAttrs.version;
     hash = "sha256-YQQwTdwfHQZdUhO5HbScj/Bl8ype7TtPI3lHjvz2k04=";
   };
+
   # It doesn't provide a composer.lock file, we have to generate manually.
   composerLock = ./composer.lock;
-  vendorHash = "sha256-dYg7cULL4gquR5EenA0lD9ZC9Ge4qNwFFDNhELKgSso=";
+  vendorHash = "sha256-TM0dyr90bUDxUwywwkeHh0pAWkTB8FV3ricWCHGxA7k=";
 
   meta = {
     description = "Lightweight CalDAV+CardDAV server that offers an extensive web interface with easy management of users, address books and calendars";
     homepage = "https://sabre.io/baikal/";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ wrvsrx ];
-    # vendorHash non-reproducible
-    broken = true;
   };
 })

From ee566476c133e4fd35500ce846dd80b40d1b2be4 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sat, 13 Dec 2025 17:35:27 +0100
Subject: [PATCH 04/40] bookstack: update `vendorHash`

---
 pkgs/by-name/bo/bookstack/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/bo/bookstack/package.nix b/pkgs/by-name/bo/bookstack/package.nix
index 1bfd9cf6d8b8..04c481a763cf 100644
--- a/pkgs/by-name/bo/bookstack/package.nix
+++ b/pkgs/by-name/bo/bookstack/package.nix
@@ -17,7 +17,7 @@ php83.buildComposerProject2 (finalAttrs: {
     hash = "sha256-2JyWCP2ISgl82P6W5dL5Zbl+phgREQEonQ+12fu3q/E=";
   };
 
-  vendorHash = "sha256-7T2pdzjqkT0bRw1d7IVVFHjJ22qKNj4czf5q8Xbs/aw=";
+  vendorHash = "sha256-tuVei2GRTrYyJQtX7Y7A4pgCjqhS+xjaH1FoCwjrHUg=";
 
   passthru = {
     phpPackage = php83;

From ba1510c5e90e56d29f475d91e0b8981ebe0a4b82 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:33:35 +0100
Subject: [PATCH 05/40] composer-require-checker: update `vendorHash`

---
 pkgs/by-name/co/composer-require-checker/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/composer-require-checker/package.nix b/pkgs/by-name/co/composer-require-checker/package.nix
index af00224e4b3d..b600f997f041 100644
--- a/pkgs/by-name/co/composer-require-checker/package.nix
+++ b/pkgs/by-name/co/composer-require-checker/package.nix
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-cTXXPsHI2yiHSakiWuuxripGLvkwmzIAADqKtwHOI7c=";
   };
 
-  vendorHash = "sha256-ZUAXo4X4B7Z6wfcmv7L1DFvD4Lx1sSoMmw1gR5nDEP0=";
+  vendorHash = "sha256-1c0PtgqHttqiOPdlHHTE4qRQx8xMsX/nXqsj3iyTgnQ=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

From 51be376a08278d648cb58df09bf70b04cd4adad8 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:34:52 +0100
Subject: [PATCH 06/40] davis: update `vendorHash`

---
 pkgs/by-name/da/davis/package.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/da/davis/package.nix b/pkgs/by-name/da/davis/package.nix
index 26b24ee51bfa..f4b66521c282 100644
--- a/pkgs/by-name/da/davis/package.nix
+++ b/pkgs/by-name/da/davis/package.nix
@@ -13,12 +13,11 @@ php.buildComposerProject2 (finalAttrs: {
     owner = "tchapi";
     repo = "davis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-okysA35sdtvbyn90fqGbhGr2yWYAw1DBJYBBhPep6T0=";
+    hash = "sha256-YLVfcoC8cIcCfi7R2zWXNxD4P+KIXOCL+MqFEt2Z7Tc=";
   };
 
-  vendorHash = "sha256-j28IsT7tdTg7+M8KwBa1LDWw0YGgv9EGnaCQNeTJZyw=";
-
   composerNoPlugins = false;
+  vendorHash = "sha256-VpINHPy2gwA5dk8OGQjmWnCpS9JVyEAUG+bptggCybk=";
 
   postInstall = ''
     chmod -R u+w $out/share

From 85ee2f4a7746ee4599e3b0e5151a0161b15f0d06 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:36:37 +0100
Subject: [PATCH 07/40] deployer: update `vendorHash`

---
 pkgs/by-name/de/deployer/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/de/deployer/package.nix b/pkgs/by-name/de/deployer/package.nix
index 9423c04e1a55..38ebd1490915 100644
--- a/pkgs/by-name/de/deployer/package.nix
+++ b/pkgs/by-name/de/deployer/package.nix
@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-wtkixHexsJNKsLnnlHssh0IzxwWYMPKDcaf/D0zUNKk=";
   };
 
-  vendorHash = "sha256-/bf1rvoG1N6GNqisBwMqY05qhTsy7gMeWXarXgElU/M=";
+  vendorHash = "sha256-sgWPZw5HiXd7c45I0f5qnw4l2HwgLaTJwzmXw8140kk=";
 
   meta = {
     changelog = "https://github.com/deployphp/deployer/releases/tag/v${finalAttrs.version}";

From b6cd2f531634fbf29df863c180141fd15a81e883 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:37:23 +0100
Subject: [PATCH 08/40] drupal: update `vendorHash`

---
 pkgs/by-name/dr/drupal/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/dr/drupal/package.nix b/pkgs/by-name/dr/drupal/package.nix
index 031fbb6c9c15..77ec96ab2fdd 100644
--- a/pkgs/by-name/dr/drupal/package.nix
+++ b/pkgs/by-name/dr/drupal/package.nix
@@ -18,8 +18,8 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-dVCDIKqLbYHlVwv5wveXG0oHc2g3Zl6J6LG1/e8IIZw=";
   };
 
-  vendorHash = "sha256-cGSOsASv3UlzSXDP2KgrlzBIMWLB25j9LFkJZsEbTTQ=";
   composerNoPlugins = false;
+  vendorHash = "sha256-CAntERLTmR9Gf/e+qBLJqqebdXZ0E9k8ifDh75ASoRo=";
 
   passthru = {
     tests = {

From f8f1652292c322078ccb12aaf5602f21095b08b8 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:39:03 +0100
Subject: [PATCH 09/40] engelsystem: update `vendorHash`

---
 pkgs/by-name/en/engelsystem/package.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/en/engelsystem/package.nix b/pkgs/by-name/en/engelsystem/package.nix
index 7da12fd84620..4dd1df0ffc8a 100644
--- a/pkgs/by-name/en/engelsystem/package.nix
+++ b/pkgs/by-name/en/engelsystem/package.nix
@@ -4,7 +4,6 @@
   fetchYarnDeps,
   nodejs,
   yarn,
-  yarnBuildHook,
   yarnConfigHook,
   nixosTests,
   php,
@@ -23,9 +22,9 @@ php.buildComposerProject2 (finalAttrs: {
 
   inherit php;
 
-  vendorHash = "sha256-ODJgsvECw+q3sAA6pWNw4X2Png7f4G2Jty9AQSj/SgE=";
-  composoerNoDev = true;
+  composerNoDev = true;
   composerStrictValidation = false;
+  vendorHash = "sha256-JRd5FJviNf5NUI9PwRcMqdDXYBlMoBB6o5yx7dvostE=";
 
   yarnOfflineCache = fetchYarnDeps {
     pname = "${finalAttrs.pname}-yarn-deps";

From 8024f79e28ed7991014032236b0aba252ac1cf33 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Mon, 8 Dec 2025 21:38:28 +0100
Subject: [PATCH 10/40] firefly-iii: update `vendorHash`

---
 pkgs/by-name/fi/firefly-iii/package.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fi/firefly-iii/package.nix b/pkgs/by-name/fi/firefly-iii/package.nix
index 2045674058ef..f6eb5bab450d 100644
--- a/pkgs/by-name/fi/firefly-iii/package.nix
+++ b/pkgs/by-name/fi/firefly-iii/package.nix
@@ -28,17 +28,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     nodejs
     nodejs.python
     buildPackages.npmHooks.npmConfigHook
+    php84.packages.composer
     php84.composerHooks2.composerInstallHook
   ];
 
   composerVendor = php84.mkComposerVendor {
     inherit (finalAttrs) pname src version;
-    composerNoDev = true;
-    composerNoPlugins = true;
-    composerNoScripts = true;
     composerStrictValidation = true;
     strictDeps = true;
-    vendorHash = "sha256-pvPyWvPzMhn4drxK5H2ItZBRkcoIBuhMfFt4NvWS01I=";
+    vendorHash = "sha256-fLL0FAhd8r2igiZZ+wb1gse+vembHS6rzUnKe9LXXmI=";
   };
 
   npmDeps = fetchNpmDeps {

From 256989483710b8ac324af86fdcf01cb36f09bc92 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:41:44 +0100
Subject: [PATCH 11/40] flarum: update `vendorHash`

---
 pkgs/by-name/fl/flarum/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fl/flarum/package.nix b/pkgs/by-name/fl/flarum/package.nix
index 5cf89b56063d..227eb5b395fe 100644
--- a/pkgs/by-name/fl/flarum/package.nix
+++ b/pkgs/by-name/fl/flarum/package.nix
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
 
   composerLock = ./composer.lock;
   composerStrictValidation = false;
-  vendorHash = "sha256-peQMR7+Jx+oXo0HdXOHzTYB9Fn0AkELm43fiV4ssLnI=";
+  vendorHash = "sha256-EHl+Mr6y5A51EpLPAWUGtiPkLOky6KvsSY4JWHeyO28=";
 
   meta = {
     changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";

From 0900c7a43205aa4e6f3898e29f235eabefe4101d Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:43:15 +0100
Subject: [PATCH 12/40] grocy: update `vendorHash`

---
 pkgs/by-name/gr/grocy/package.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/gr/grocy/package.nix b/pkgs/by-name/gr/grocy/package.nix
index 0de3c56b4dc8..9dcbbad5d67c 100644
--- a/pkgs/by-name/gr/grocy/package.nix
+++ b/pkgs/by-name/gr/grocy/package.nix
@@ -19,7 +19,9 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-MnN6TIkNZWT+pAQf0+z5l3hj/7K/d3BfI7VAaUEKG8s=";
   };
 
-  vendorHash = "sha256-6vWV8+4tETUFBLeEoG7d8lHKILXvM7ezWbDiG11GA/s=";
+  # Upstream composer.json file is missing the name, description and license fields
+  composerStrictValidation = false;
+  vendorHash = "sha256-11+NIZX8i9uwcImwSE0HAeMc/WOCsecpMRqiba1mkrs=";
 
   offlineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
@@ -31,9 +33,6 @@ php.buildComposerProject2 (finalAttrs: {
     fixup-yarn-lock
   ];
 
-  # Upstream composer.json file is missing the name, description and license fields
-  composerStrictValidation = false;
-
   # NOTE: if patches are created from a git checkout, those should be modified
   # with `unix2dos` to make sure those apply here.
   patches = [

From 1a7280aa23d66984f0de559d2be6ac823b158652 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:45:43 +0100
Subject: [PATCH 13/40] kimai: update `vendorHash`

---
 pkgs/by-name/ki/kimai/package.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ki/kimai/package.nix b/pkgs/by-name/ki/kimai/package.nix
index facaff5e5a48..b7c2fc536a66 100644
--- a/pkgs/by-name/ki/kimai/package.nix
+++ b/pkgs/by-name/ki/kimai/package.nix
@@ -38,9 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-x62+uhrwlbjRGitMlvxSZpN1Pb1VrWGVJ+WxCvO2w9A=";
-
-  composerNoPlugins = false;
+  vendorHash = "sha256-3/LT5HjCpnO3Sz+NshrSMTujtYka0FMyT56qmiEi2t4=";
 
   postInstall = ''
     # Make available the console utility, as Kimai doesn't list this in
@@ -50,7 +48,7 @@ php.buildComposerProject2 (finalAttrs: {
 
     # Install bundled assets. This is normally done in the `composer install`
     # post-install script, but it's being skipped.
-    (cd "$out"/share/php/kimai && php ./bin/console assets:install)
+    # (cd "$out"/share/php/kimai && php ./bin/console assets:install)
   '';
 
   passthru.tests = {

From 152c67beae1c8640356a5252f60d197184c50dbc Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:49:16 +0100
Subject: [PATCH 14/40] laravel: update `vendorHash`

---
 pkgs/by-name/la/laravel/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/la/laravel/package.nix b/pkgs/by-name/la/laravel/package.nix
index 5932a5d0d388..1dd2e51baa93 100644
--- a/pkgs/by-name/la/laravel/package.nix
+++ b/pkgs/by-name/la/laravel/package.nix
@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
   nativeBuildInputs = [ makeWrapper ];
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-TUCv+zXE+xmdtN0vDToEqlw4+WOi+xX87IrGmUAeQkM=";
+  vendorHash = "sha256-fQGj673X6Zmm+6jy2WZ8su8zELPlcI6z4u5NbtQ9gAk=";
 
   # Adding npm (nodejs) and php composer to path
   postInstall = ''

From 6fdbdb54be57d34a8bee67806481e68947e6f242 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:50:38 +0100
Subject: [PATCH 15/40] movim: update `vendorHash`

---
 pkgs/by-name/mo/movim/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/mo/movim/package.nix b/pkgs/by-name/mo/movim/package.nix
index 637ff1e8e630..ce13c958c529 100644
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@@ -88,7 +88,7 @@ php.buildComposerProject2 (finalAttrs: {
     ++ lib.optional minify.style.enable lightningcss
     ++ lib.optional minify.svg.enable scour;
 
-  vendorHash = "sha256-t95OVDUb7hJfbokFhSOyGP02laVcTTJX7bK/reYJ99I=";
+  vendorHash = "sha256-8tEs+kQGB0pmhEQndOOOUDTFkIq+OvyKTmi9YAvK6qc=";
 
   postPatch = ''
     # Our modules are already wrapped, removes missing *.so warnings;

From 9ee00467149b9ea95a0e428ba81bfe53fd5c2f6e Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:51:44 +0100
Subject: [PATCH 16/40] pdepend: update `vendorHash`

---
 pkgs/by-name/pd/pdepend/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/pd/pdepend/package.nix b/pkgs/by-name/pd/pdepend/package.nix
index d8bd332f8fbe..9fc769253e4e 100644
--- a/pkgs/by-name/pd/pdepend/package.nix
+++ b/pkgs/by-name/pd/pdepend/package.nix
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-uK+nJFXDVPYFbosAUxqu+mmNsD7AnZ18NnIN9FYAaPQ=";
+  vendorHash = "sha256-IowPh4CymahgfbnvLS2QWu8e+TXya9AszTK+mlR/DTY=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

From b4ac35c597529d47d3136c57b72d28ea5cbf0938 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:52:41 +0100
Subject: [PATCH 17/40] pest: update `vendorHash`

---
 pkgs/by-name/pe/pest/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/pe/pest/package.nix b/pkgs/by-name/pe/pest/package.nix
index a5be5a24b227..dd20e538001d 100644
--- a/pkgs/by-name/pe/pest/package.nix
+++ b/pkgs/by-name/pe/pest/package.nix
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-4CpyerXmfXbwsNsK16V+GY3Rzo4BfavGpOVITD14p8w=";
+  vendorHash = "sha256-Lv+wbOJVO7gGs4bOcECKyaw7+k3Z4f8gbNEv9uk4he8=";
 
   meta = {
     changelog = "https://github.com/pestphp/pest/releases/tag/v${finalAttrs.version}";

From d005d34f76951c519cd96cca192642bf78d2c3be Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:53:37 +0100
Subject: [PATCH 18/40] phel: update `vendorHash`

---
 pkgs/by-name/ph/phel/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ph/phel/package.nix b/pkgs/by-name/ph/phel/package.nix
index 8a440d57ab02..bed443ae145a 100644
--- a/pkgs/by-name/ph/phel/package.nix
+++ b/pkgs/by-name/ph/phel/package.nix
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-v/xRYzKCwF1kKDV00jK7Cwz3TupkNZVec/h2JnhVq4E=";
   };
 
-  vendorHash = "sha256-oABfUeL52XFKUui1tBuoyK2B7kBcYdLuVo4OllX07AQ=";
+  vendorHash = "sha256-rA05SIv+rP90KHTeYTym1Db64KMOY6iXnLh3I/DY3ks=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

From f48d90b64e49917c14414b9bc00738498914545f Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:54:35 +0100
Subject: [PATCH 19/40] phpactor: update `vendorHash`

---
 pkgs/by-name/ph/phpactor/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ph/phpactor/package.nix b/pkgs/by-name/ph/phpactor/package.nix
index 6be056dd7b52..d9ce4963d4f0 100644
--- a/pkgs/by-name/ph/phpactor/package.nix
+++ b/pkgs/by-name/ph/phpactor/package.nix
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-A/ajGQ75z/EdWFFJK0kLjcSFfa9z15TZCNZZpwq9k2E=";
   };
 
-  vendorHash = "sha256-qLcwAmnkh3nxrvdDa/OI3RQOi/4qhxURhcXM1r5iE88=";
+  vendorHash = "sha256-Y0U5GH2NGOhwDSqsJnDxUe+VOQbKrCOZDX6f2pCeUqY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 15fe4b371544f745093db6cc604975b4a5b86775 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:55:26 +0100
Subject: [PATCH 20/40] phpdocumentor: update `vendorHash`

---
 pkgs/by-name/ph/phpdocumentor/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/ph/phpdocumentor/package.nix b/pkgs/by-name/ph/phpdocumentor/package.nix
index 8734715b842c..d8b4b101113f 100644
--- a/pkgs/by-name/ph/phpdocumentor/package.nix
+++ b/pkgs/by-name/ph/phpdocumentor/package.nix
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-T1aN/I06OdQnMxjutSsk3nNyXQ0Z+GWY6fADvJc7Iks=";
   };
 
-  vendorHash = "sha256-bTzDCHJHp31oruOHMxzfkJooPHGn4DUeGG0NzGLSZLs=";
+  vendorHash = "sha256-IPKwEESlcwGotRAM1ZnTB+wbFF6tkMZTnpQ1aYDakSQ=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
@@ -30,7 +30,6 @@ php.buildComposerProject2 (finalAttrs: {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
 

From 948d66d8436cefce1b886a3d8dceb4907842d67c Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:56:49 +0100
Subject: [PATCH 21/40] pixelfed: update `vendorHash`

---
 pkgs/by-name/pi/pixelfed/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/pi/pixelfed/package.nix b/pkgs/by-name/pi/pixelfed/package.nix
index beff15a82c2f..a6c280df71e5 100644
--- a/pkgs/by-name/pi/pixelfed/package.nix
+++ b/pkgs/by-name/pi/pixelfed/package.nix
@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-FxJWoFNyIGQ6o9g2Q0/jaBMyeH8UnbTgha2goHAurvY=";
   };
 
-  vendorHash = "sha256-ciHP6dE42pXupZl4V37RWcHkIZ+xf6cnpwqd3C1dNmQ=";
+  vendorHash = "sha256-4x+vvkQUhqxBwm+9Lx7n6Ww6qvfLwqd8IXXCuCSAijE=";
 
   postInstall = ''
     chmod -R u+w $out/share

From 9c9bcadd0300b1160533684e3474fce3f486e3b4 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:58:00 +0100
Subject: [PATCH 22/40] postfixadmin: update `vendorHash`

---
 pkgs/by-name/po/postfixadmin/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/po/postfixadmin/package.nix b/pkgs/by-name/po/postfixadmin/package.nix
index e7b72492e147..baea81c99de4 100644
--- a/pkgs/by-name/po/postfixadmin/package.nix
+++ b/pkgs/by-name/po/postfixadmin/package.nix
@@ -18,11 +18,10 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-mr5FBURTGP2J3JMlcexXjz4GFJNqPR4rZyqHVN7+6iM=";
   };
 
-  vendorHash = "sha256-gv6QYuHGo2r2WgtLPLco/PmKxYSijDkpWoF/vIR5y5s=";
-
   # Upstream does not ship a lock file, we have to maintain our own for now.
   # https://github.com/postfixadmin/postfixadmin/issues/948
   composerLock = ./composer.lock;
+  vendorHash = "sha256-uyHEfWCC6V4d+ez7FbqBKrh4IfbQ2pgD4UvbdGEfobI=";
 
   postInstall = ''
     out_dir="$out"/share/php/postfixadmin/

From 1acbd8ef1896965ffce4d1f3d9651ee4bc7b62df Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:58:53 +0100
Subject: [PATCH 23/40] pretty-php: update `vendorHash`

---
 pkgs/by-name/pr/pretty-php/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/pr/pretty-php/package.nix b/pkgs/by-name/pr/pretty-php/package.nix
index 16c1974f1c69..288a3550622f 100644
--- a/pkgs/by-name/pr/pretty-php/package.nix
+++ b/pkgs/by-name/pr/pretty-php/package.nix
@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-V+xncL02fY0olGxqjWBWqD6N1J0XOeOPe55aULuN2bA=";
   };
 
-  vendorHash = "sha256-62KnzttuLsDP7DlEING/koS7lxf5A673F5DwppJs3vw=";
+  vendorHash = "sha256-r5LhN2OjEpiHR0RtK7d/pMd8bqFJbM8CuCXEDGjgG4A=";
 
   passthru = {
     tests.version = testers.testVersion {

From 613a06b4c4f349560332f4c149ede611cd3e6e88 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 09:59:48 +0100
Subject: [PATCH 24/40] pretty-php: use `versionCheckHook`

---
 pkgs/by-name/pr/pretty-php/package.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/pr/pretty-php/package.nix b/pkgs/by-name/pr/pretty-php/package.nix
index 288a3550622f..2a2f30aeaca8 100644
--- a/pkgs/by-name/pr/pretty-php/package.nix
+++ b/pkgs/by-name/pr/pretty-php/package.nix
@@ -2,7 +2,8 @@
   lib,
   php,
   fetchFromGitHub,
-  testers,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "pretty-php";
@@ -17,12 +18,11 @@ php.buildComposerProject2 (finalAttrs: {
 
   vendorHash = "sha256-r5LhN2OjEpiHR0RtK7d/pMd8bqFJbM8CuCXEDGjgG4A=";
 
-  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      command = "HOME=$TMPDIR pretty-php --version";
-    };
-  };
+  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Opinionated PHP code formatter";

From b42c44d76ca30d1a15ef90ccf31ef652e9f3e24d Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:02:21 +0100
Subject: [PATCH 25/40] psysh: unbreak, update `vendorHash`

---
 pkgs/by-name/ps/psysh/package.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ps/psysh/package.nix b/pkgs/by-name/ps/psysh/package.nix
index a286afa171f5..ab61bfc1dd1a 100644
--- a/pkgs/by-name/ps/psysh/package.nix
+++ b/pkgs/by-name/ps/psysh/package.nix
@@ -40,12 +40,12 @@ php.buildComposerProject2 (finalAttrs: {
 
     preBuild = ''
       composer config platform.php 7.4
-      composer require --no-update symfony/polyfill-iconv:1.31 symfony/polyfill-mbstring:1.31
-      composer require --no-update --dev roave/security-advisories:dev-latest
-      composer update --lock --no-install
+      composer require --no-cache --no-update symfony/polyfill-iconv:1.31 symfony/polyfill-mbstring:1.31
+      composer require --no-cache --no-update --dev roave/security-advisories:dev-latest
+      composer update --no-cache --lock --no-install
     '';
 
-    vendorHash = "sha256-8l5bQ+VnLOtPUspMN1f+iXo7LldPTuYqyrAeW2aVoH8=";
+    vendorHash = "sha256-S3rekG0KPHk6cmQecmb5ETQ1V4ey5+pK+PpHNSEcXNw=";
   };
 
   doInstallCheck = true;
@@ -58,7 +58,5 @@ php.buildComposerProject2 (finalAttrs: {
     mainProgram = "psysh";
     license = lib.licenses.mit;
     homepage = "https://psysh.org/";
-    # `composerVendor` doesn't build
-    broken = true;
   };
 })

From 67604bf9a9ad6fbcfbddf1b36ceb8fef86bf22f8 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:03:35 +0100
Subject: [PATCH 26/40] roave-backward-compatibility-check: update `vendorHash`

---
 pkgs/by-name/ro/roave-backward-compatibility-check/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
index cf2f87d731a9..155d6752055d 100644
--- a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
+++ b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-vhoV8AkkcL1pDmHkpPYs5lD6TUcvMC6BXkQF1T2esIE=";
   };
 
-  vendorHash = "sha256-ADqWN0cF9hB+s9rfza0bQ3pB6NZ9NMzvDhN8sdL3Sg8=";
+  vendorHash = "sha256-LBvqnBcSpjffS3cjgVgql8eNmaP45uNx9BKr72Mr+ZY=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

From c813a34cb8e0f0fdbfa1d939f7cdae9b0de04a12 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:05:03 +0100
Subject: [PATCH 27/40] snipe-it: update `vendorHash`

---
 pkgs/by-name/sn/snipe-it/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/sn/snipe-it/package.nix b/pkgs/by-name/sn/snipe-it/package.nix
index 446068513729..dc4329e2b130 100644
--- a/pkgs/by-name/sn/snipe-it/package.nix
+++ b/pkgs/by-name/sn/snipe-it/package.nix
@@ -21,7 +21,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-hqJUhjL4k6fC5ed8pFOb3Ym0CmelfVZYWqmMuTjHN/U=";
   };
 
-  vendorHash = "sha256-DXkRKijjkT4GI0sMj3T8fD90weCLwe681yBqKs4/cVI=";
+  vendorHash = "sha256-6ryHXXWtih/eHSQk36NSf4UjZZfUH+zjnyZoLnLNqHU=";
 
   postInstall = ''
     snipe_it_out="$out/share/php/snipe-it"

From 0265a6e1bf6c0c023948c18453b5e8884e3e9dfa Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:06:39 +0100
Subject: [PATCH 28/40] phpPackages.castor: update `vendorHash`

---
 pkgs/development/php-packages/castor/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/castor/default.nix b/pkgs/development/php-packages/castor/default.nix
index 2d4000abe649..71b5ce0c09ac 100644
--- a/pkgs/development/php-packages/castor/default.nix
+++ b/pkgs/development/php-packages/castor/default.nix
@@ -18,7 +18,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-ot4akuKhNtEXukiDSy69q75phx6EvkJsL0XHAN+el+M=";
   };
 
-  vendorHash = "sha256-S5NCV3wd/EA282NA0Wbtj7gbZw9YU835cr5CmpAnapc=";
+  vendorHash = "sha256-fLx4uLS9708IFKnBus3R7nt6V/BCsZZflYEhwzUkXzc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -39,7 +39,6 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   meta = {
-    broken = lib.versionOlder php.version "8.2";
     changelog = "https://github.com/jolicode/castor/blob/v${finalAttrs.version}/CHANGELOG.md";
     description = "DX oriented task runner and command launcher built with PHP";
     homepage = "https://github.com/jolicode/castor";

From cc8d8aaf1b56c0f81685e4e0e25c67f3ba006a77 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:07:36 +0100
Subject: [PATCH 29/40] phpPackages.grumphp: update `vendorHash`

---
 pkgs/development/php-packages/grumphp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/grumphp/default.nix b/pkgs/development/php-packages/grumphp/default.nix
index d9c42c328551..29db90bd5a7a 100644
--- a/pkgs/development/php-packages/grumphp/default.nix
+++ b/pkgs/development/php-packages/grumphp/default.nix
@@ -12,11 +12,11 @@ php.buildComposerProject2 (finalAttrs: {
   src = fetchFromGitHub {
     owner = "phpro";
     repo = "grumphp";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-g2V2clNI0+KzKAPStq1vJZ3gHpBV1EbduWBmzRnuzv8=";
   };
 
-  vendorHash = "sha256-wDxrLsBA8TMc6Fk+voeHlxQNfJaaef1ydg0ppuJgO2E=";
+  vendorHash = "sha256-lgXDxfBTCtGlrDzi+leeE8J8VIsaKpwyB1CUTUvdpMg=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

From 02fbc1d2bd358676aa6ec65027b23a5fe231b4bc Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sun, 7 Dec 2025 16:12:51 +0100
Subject: [PATCH 30/40] phpPackages.phive: update `vendorHash`

---
 pkgs/development/php-packages/phive/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/php-packages/phive/default.nix b/pkgs/development/php-packages/phive/default.nix
index 35c108c5200d..81b5e11ba06e 100644
--- a/pkgs/development/php-packages/phive/default.nix
+++ b/pkgs/development/php-packages/phive/default.nix
@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-dv9v1KCLNheFmrRQ7cID5WFvoiH0OWVPWSrN023dEqA=";
   };
 
-  vendorHash = "sha256-U6BHAd4tWQKm6uCJ5sM51PltXhF3J4ieTnbC060+8Jg=";
+  vendorHash = "sha256-9X8z+A4uHsO1w8CdQkKZ/sZ+5BHooRD2q7ij6epr/Yc=";
 
   meta = {
     changelog = "https://github.com/phar-io/phive/releases/tag/${finalAttrs.version}";

From 314ed3b23524bf8326945636517222d36637939c Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:09:37 +0100
Subject: [PATCH 31/40] phpPackages.php-codesniffer: update `vendorHash`

---
 pkgs/development/php-packages/php-codesniffer/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/php-packages/php-codesniffer/default.nix b/pkgs/development/php-packages/php-codesniffer/default.nix
index c05c79048294..473906ed199f 100644
--- a/pkgs/development/php-packages/php-codesniffer/default.nix
+++ b/pkgs/development/php-packages/php-codesniffer/default.nix
@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-2fubJMn44pS+++QgK66vm4YTT+0zdgtAJVHKvvWO/QA=";
   };
 
-  vendorHash = "sha256-SswaHYkDhuW2HZX7QiBd7K6wTmt42z2/TpB7HP68b7k=";
+  vendorHash = "sha256-t+cNnrs/4xzIDg3qM/MIRyu1Ulen03s2asZ2JuOxQgI=";
 
   meta = {
     changelog = "https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/${finalAttrs.version}";

From a629398e07c44937b8414b5b2299c054b9d71405 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:10:27 +0100
Subject: [PATCH 32/40] phpPackages.php-cs-fixer: update `vendorHash`

---
 pkgs/development/php-packages/php-cs-fixer/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/php-cs-fixer/default.nix b/pkgs/development/php-packages/php-cs-fixer/default.nix
index 93c934d83549..f1a6c3fb7c15 100644
--- a/pkgs/development/php-packages/php-cs-fixer/default.nix
+++ b/pkgs/development/php-packages/php-cs-fixer/default.nix
@@ -17,14 +17,13 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-I4F6WDnWDEmLJFRGMS2QV62jaNAtZoTNQBoH3gT3OAw=";
+  vendorHash = "sha256-iQRY9DY2AEHuP3KJKC9ei8xcXgMvzxvyFl/9FwtN+kE=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
   meta = {
-    broken = lib.versionOlder php.version "8.2";
     changelog = "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases/tag/v${finalAttrs.version}";
     description = "Tool to automatically fix PHP coding standards issues";
     homepage = "https://cs.symfony.com/";

From 4904223b71244fe826560845e9fa2c095c83c8c1 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:11:13 +0100
Subject: [PATCH 33/40] phpPackages.php-parallel-lint: update `vendorHash`

---
 pkgs/development/php-packages/php-parallel-lint/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/php-parallel-lint/default.nix b/pkgs/development/php-packages/php-parallel-lint/default.nix
index e7f93224f1ab..e6735d178b88 100644
--- a/pkgs/development/php-packages/php-parallel-lint/default.nix
+++ b/pkgs/development/php-packages/php-parallel-lint/default.nix
@@ -17,11 +17,11 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-AQAASj5vrSE1xkJ/SZHU4GwOWNobe9ES0Yo+YrLH354=";
+  vendorHash = "sha256-tAS4EAFb3SyL3j6oIB+YTyZPQcrRbyDFt4QzOwEB8wU=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
-  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Tool to check syntax of PHP files faster than serial check with fancier output";

From 88390140409af9e371c528e26f334c4abb573c73 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:12:13 +0100
Subject: [PATCH 34/40] phpPackages.phpinsights: update `vendorHash`

---
 pkgs/development/php-packages/phpinsights/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/phpinsights/default.nix b/pkgs/development/php-packages/phpinsights/default.nix
index 13d0ebf7b640..9872955ffa43 100644
--- a/pkgs/development/php-packages/phpinsights/default.nix
+++ b/pkgs/development/php-packages/phpinsights/default.nix
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-uy8/bkgjDXnt544S70IOwX9I8U0lMLAkbiBDYXyJBcY=";
+  vendorHash = "sha256-/Kvj3vd2YG7DFvodtvEkWdAsbMazBHJHmUTBexxFsII=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
@@ -26,7 +26,6 @@ php.buildComposerProject2 (finalAttrs: {
   doInstallCheck = true;
 
   meta = {
-    broken = lib.versionOlder php.version "8.2";
     changelog = "https://github.com/nunomaduro/phpinsights/releases/tag/v${finalAttrs.version}";
     description = "Instant PHP quality checks from your console";
     homepage = "https://phpinsights.com/";

From ae09708977bde0f25e17e0b73ec2ed86d72ff17d Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:13:23 +0100
Subject: [PATCH 35/40] phpPackages.phpmd: update `vendorHash`

---
 pkgs/development/php-packages/phpmd/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/php-packages/phpmd/default.nix b/pkgs/development/php-packages/phpmd/default.nix
index 06533e74a241..18a2adfd73fd 100644
--- a/pkgs/development/php-packages/phpmd/default.nix
+++ b/pkgs/development/php-packages/phpmd/default.nix
@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
   # Missing `composer.lock` from the repository.
   # Issue open at https://github.com/phpmd/phpmd/issues/1056
   composerLock = ./composer.lock;
-  vendorHash = "sha256-tiL8PL6Muc/i4Il1rCeEKenCmIEVn3rHFZInbUGQW9o=";
+  vendorHash = "sha256-Vx5JolyOeCRst+wzqPB7bZopBa2LU7SOJmA4tEvWj1c=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";

From 1e2be08cf94f91cf5cd4291bf6cc92048d57c923 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:14:02 +0100
Subject: [PATCH 36/40] phpPackages.phpstan: update `vendorHash`

---
 pkgs/development/php-packages/phpstan/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index a509590a3a3e..13b745d486d6 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -16,8 +16,8 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-fP+R22TN3I/Afn+N/6sqlYuN0GxTzPt3bSZjtFrkr1A=";
   };
 
-  vendorHash = "sha256-OYPX3ofhe71zb02FSzbQMwCuw/iY4NKaRqYxZ65CCys=";
   composerStrictValidation = false;
+  vendorHash = "sha256-NW5yx9jD7aXmqq9kzSNr/U1CkW0VN8qm0yHOQlxVi0c=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

From f56525a97a8ad93ff4d3509c0a919acc59987bc6 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 7 Nov 2025 10:16:14 +0100
Subject: [PATCH 37/40] phpPackages.psalm: update `vendorHash`

---
 pkgs/development/php-packages/psalm/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/psalm/default.nix b/pkgs/development/php-packages/psalm/default.nix
index 7e0df378b41f..ca0e06e9cb16 100644
--- a/pkgs/development/php-packages/psalm/default.nix
+++ b/pkgs/development/php-packages/psalm/default.nix
@@ -31,14 +31,13 @@ php.buildComposerProject2 (finalAttrs: {
     ${lib.getExe php} -r '$phar = new Phar("${psalm-phar}"); $phar->extractTo(".", "composer.lock");'
     cp composer.lock $out
   '';
-  vendorHash = "sha256-18FAMuOO6rWAQEIJOLGxj/Avr5ZQRuI4ao2RL2nJlYc=";
+  vendorHash = "sha256-gtN3Gml/gNeg7FBNnr6I7IV0zF6iK4oWproRESPbK/4=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
   meta = {
-    broken = lib.versionOlder php.version "8.2";
     changelog = "https://github.com/vimeo/psalm/releases/tag/${finalAttrs.version}";
     description = "Static analysis tool for finding errors in PHP applications";
     homepage = "https://github.com/vimeo/psalm";

From 2cd998dc090afc20b75e20a57e30fe03b5f7bc93 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sun, 9 Nov 2025 17:51:34 +0100
Subject: [PATCH 38/40] nextcloud32Packages.apps.hmr_enabler: update
 `vendorHash`

---
 pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix b/pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix
index d70d41a2f33a..35f2991515f0 100644
--- a/pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix
+++ b/pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix
@@ -18,8 +18,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerNoDev = false;
-
-  vendorHash = "sha256-KWvHgPeTLy/a6NusLpKBgYJWjSzc+MNF7cE5u31JqKs=";
+  vendorHash = "sha256-js9O89jIRxX2DKI+LYjL3d9RsLdzUB4iUNUgngTryz8=";
 
   postInstall = ''
     chmod -R u+w $out/share

From 5ffdb0dd09e931f2bf1cadb8487992547d9dc507 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Mon, 8 Dec 2025 12:39:36 +0100
Subject: [PATCH 39/40] phpPackages.composer: 2.8.12 -> 2.9.2

---
 pkgs/development/php-packages/composer/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index c36e401e3b15..d4656a641aa3 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -23,13 +23,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "composer";
-  version = "2.8.12";
+  version = "2.9.2";
 
   # Hash used by ../../../build-support/php/pkgs/composer-phar.nix to
   # use together with the version from this package to keep the
   # bootstrap phar file up-to-date together with the end user composer
   # package.
-  passthru.pharHash = "sha256-9EbqcZcIu4X8v07xje9dBRXx+bTXA/bYIMnBZW4QovI=";
+  passthru.pharHash = "sha256-Rx8thXq/DsGK97BV5hRyIU2RrbJPm9u7hkwcZPqtfdY=";
 
   composer = callPackage ../../../build-support/php/pkgs/composer-phar.nix {
     inherit (finalAttrs) version;
@@ -40,7 +40,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "composer";
     repo = "composer";
     tag = finalAttrs.version;
-    hash = "sha256-UHCsdJmoE7X2ZiiBAWfC004FUMqHyd0URt+v8R3hn70=";
+    hash = "sha256-Ke+QGcKPqm1wEVVYgUCL0K3nT+qmzWpRX6HcZnzdhgA=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
@@ -94,7 +94,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = "sha256-gnCPcp+c2dFL+9MJf0JRCQ5E95/dET1F0ZZAYj/rWq4=";
+    outputHash = "sha256-Fe/aCn77nVuUc1Bp2TCZHJxe5oh4fwWw9Lj4So89pmE=";
   };
 
   installPhase = ''

From b19a7ee9d6c6845babdf2bf81ca717a9d5525a4a Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Wed, 10 Dec 2025 08:11:58 +0100
Subject: [PATCH 40/40] phpPackages.composer: bootstrap with
 `php.buildComposerProject2` builder

---
 .../php-packages/composer/default.nix         | 108 ++++--------------
 1 file changed, 22 insertions(+), 86 deletions(-)

diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index d4656a641aa3..91a29988a93b 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -1,41 +1,20 @@
 {
   lib,
-  stdenvNoCC,
   fetchFromGitHub,
   callPackage,
   php,
-  unzip,
-  _7zz,
-  xz,
-  gitMinimal,
-  curl,
-  cacert,
   makeBinaryWrapper,
+  _7zz,
+  curl,
+  gitMinimal,
+  unzip,
+  xz,
   versionCheckHook,
 }:
-
-/*
-    XXX IMPORTANT
-
-    Make sure to check if the `vendorHash` of `buildComposerProject2` changes when updating!
-    See https://github.com/NixOS/nixpkgs/issues/451395
-*/
-
-stdenvNoCC.mkDerivation (finalAttrs: {
+php.buildComposerProject2 (finalAttrs: {
   pname = "composer";
   version = "2.9.2";
 
-  # Hash used by ../../../build-support/php/pkgs/composer-phar.nix to
-  # use together with the version from this package to keep the
-  # bootstrap phar file up-to-date together with the end user composer
-  # package.
-  passthru.pharHash = "sha256-Rx8thXq/DsGK97BV5hRyIU2RrbJPm9u7hkwcZPqtfdY=";
-
-  composer = callPackage ../../../build-support/php/pkgs/composer-phar.nix {
-    inherit (finalAttrs) version;
-    inherit (finalAttrs.passthru) pharHash;
-  };
-
   src = fetchFromGitHub {
     owner = "composer";
     repo = "composer";
@@ -43,67 +22,20 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-Ke+QGcKPqm1wEVVYgUCL0K3nT+qmzWpRX6HcZnzdhgA=";
   };
 
-  nativeBuildInputs = [ makeBinaryWrapper ];
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
 
-  buildInputs = [ php ];
-
-  vendor = stdenvNoCC.mkDerivation {
-    pname = "${finalAttrs.pname}-vendor";
-
-    inherit (finalAttrs) src version;
-
-    nativeBuildInputs = [
-      cacert
-      finalAttrs.composer
-    ];
-
-    dontPatchShebangs = true;
-    doCheck = true;
-
-    buildPhase = ''
-      runHook preBuild
-
-      composer install --no-dev --no-interaction --no-progress --optimize-autoloader
-
-      runHook postBuild
-    '';
-
-    checkPhase = ''
-      runHook preCheck
-
-      composer validate
-
-      runHook postCheck
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      cp -ar . $out/
-
-      runHook postInstall
-    '';
-
-    env = {
-      COMPOSER_CACHE_DIR = "/dev/null";
-      COMPOSER_DISABLE_NETWORK = "0";
-      COMPOSER_HTACCESS_PROTECT = "0";
-      COMPOSER_MIRROR_PATH_REPOS = "1";
-      COMPOSER_ROOT_VERSION = finalAttrs.version;
-    };
-
-    outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
-    outputHash = "sha256-Fe/aCn77nVuUc1Bp2TCZHJxe5oh4fwWw9Lj4So89pmE=";
+  # Bootstrapping Composer (source) with Composer (PHAR distribution).
+  # Override the default `composer` attribute to prevent infinite recursion.
+  composer = callPackage ../../../build-support/php/pkgs/composer-phar.nix {
+    inherit (finalAttrs) version;
+    inherit (finalAttrs.passthru) pharHash;
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -ar ${finalAttrs.vendor}/* $out/
-    chmod +w $out/bin
+  vendorHash = "sha256-cqELlLH7d5KR62uVn7VtpQhVjkhXZkclXfc5d8RAG5Y=";
 
+  postInstall = ''
     wrapProgram $out/bin/composer \
       --prefix PATH : ${
         lib.makeBinPath [
@@ -114,14 +46,18 @@ stdenvNoCC.mkDerivation (finalAttrs: {
           xz
         ]
       }
-
-    runHook postInstall
   '';
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
+  # Hash used by ../../../build-support/php/pkgs/composer-phar.nix to
+  # use together with the version from this package to keep the
+  # bootstrap phar file up-to-date together with the end user composer
+  # package.
+  passthru.pharHash = "sha256-Rx8thXq/DsGK97BV5hRyIU2RrbJPm9u7hkwcZPqtfdY=";
+
   meta = {
     changelog = "https://github.com/composer/composer/releases/tag/${finalAttrs.version}";
     description = "Dependency Manager for PHP";