Do we need to drop composer 2.8 support?

[convenient]

The system requirements says that composer 2.8 is supported on many versions of Magento, the 2.4.9 / 2.4.8 and 2.4.7 series all "support" it.

https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements

But the 2.8 series is no longer in security support

And the composer 2.8 series has a security advisory now which suggests it should not be used

$ composer require composer/composer:">=2.8.0,<2.9.0"
./composer.json has been updated
Running composer update composer/composer
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires composer/composer >=2.8.0,<2.9.0, found composer/composer[2.8.0, ..., 2.8.12] but these were not loaded, because they are affected by security advisories ("PKSA-1gck-s111-yq7g"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

Installation failed, reverting ./composer.json to its original content.

When trying to deploy on adobe cloud we set in the .magento.app.yaml the following, and it will always fail the deployment

dependencies:
  php:
    composer/composer: '2.8.12'

Given that the advisory https://packagist.org/security-advisories/PKSA-1gck-s111-yq7g is tagged against composer/composer it seems like support for the 2.8 series is no longer valid?

[m2-assistant]

Hi @convenient. Thank you for your report.
To speed up processing of this issue, make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce.

• For more details, review the Magento Contributor Assistant documentation.
• Add a comment to assign the issue: @magento I am working on this
• To learn more about issue processing workflow, refer to the Code Contributions.

---

Join Magento Community Engineering Slack and ask your questions in #github channel.
⚠️ According to the Magento Contribution requirements, all issues must go through the Community Contributions Triage process. Community Contributions Triage is a public meeting.
🕙 You can find the schedule on the Magento Community Calendar page.
📞 The triage of issues happens in the queue order. If you want to speed up the delivery of your contribution, join the Community Contributions Triage session to discuss the appropriate ticket.

[hostep]

Makes sense, but this report should probably be moved to https://github.com/AdobeDocs/commerce-operations.en/?