fix(composer): disable composer plugins (#10989)

Co-authored-by: Michael Kriese <michael.kriese@visualon.de>

lib/manager/composer/__snapshots__/artifacts.spec.ts.snap

@@ -25,7 +25,7 @@ Array [
 exports[`.updateArtifacts() disables ignorePlatformReqs 1`] = `
 Array [
   Object {
-    "cmd": "composer update --with-dependencies --no-ansi --no-interaction --no-scripts --no-autoloader",
+    "cmd": "composer update --with-dependencies --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -49,7 +49,7 @@ Array [
 exports[`.updateArtifacts() performs lockFileMaintenance 1`] = `
 Array [
   Object {
-    "cmd": "composer install --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader",
+    "cmd": "composer install --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -97,7 +97,7 @@ Array [
 exports[`.updateArtifacts() returns updated composer.lock 1`] = `
 Array [
   Object {
-    "cmd": "composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader",
+    "cmd": "composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -133,7 +133,7 @@ Array [
     },
   },
   Object {
-    "cmd": "docker run --rm --name=renovate_composer --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e COMPOSER_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/composer:1.10.17 bash -l -c \\"composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader\\"",
+    "cmd": "docker run --rm --name=renovate_composer --label=renovate_child -v \\"/tmp/github/some/repo\\":\\"/tmp/github/some/repo\\" -v \\"/tmp/renovate/cache\\":\\"/tmp/renovate/cache\\" -e COMPOSER_CACHE_DIR -w \\"/tmp/github/some/repo\\" renovate/composer:1.10.17 bash -l -c \\"composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins\\"",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -157,7 +157,7 @@ Array [
 exports[`.updateArtifacts() supports global mode 1`] = `
 Array [
   Object {
-    "cmd": "composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader",
+    "cmd": "composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -181,7 +181,7 @@ Array [
 exports[`.updateArtifacts() supports vendor directory update 1`] = `
 Array [
   Object {
-    "cmd": "composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader",
+    "cmd": "composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",
@@ -205,7 +205,7 @@ Array [
 exports[`.updateArtifacts() uses hostRules to set COMPOSER_AUTH 1`] = `
 Array [
   Object {
-    "cmd": "composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader",
+    "cmd": "composer update --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins",
     "options": Object {
       "cwd": "/tmp/github/some/repo",
       "encoding": "utf-8",

lib/manager/composer/artifacts.ts

@@ -124,7 +124,7 @@ export async function updateArtifacts({
     }
     args += ' --no-ansi --no-interaction';
     if (!getAdminConfig().allowScripts || config.ignoreScripts) {
-      args += ' --no-scripts --no-autoloader';
+      args += ' --no-scripts --no-autoloader --no-plugins';
     }
     logger.debug({ cmd, args }, 'composer command');
     await exec(`${cmd} ${args}`, execOptions);