Composer/Symfony: dependency issues - symfony

Question

Context
I'm currently working on an OroPlatform project, which is based on Symfony 4.4 and deployed on Platform.sh.
I'm facing the following issue during the build phase of the deployment:
My app needs the package symfony/process 4.4.X
I don't know why, but on the Platform.sh server my app uses the symfony/process package installed for the composer binary installed globally, but this one is a 5.X version
So, I've got an error and I can't install my app because it uses the 5.X version instead of the 4.X
That's why I've found a workaround by using Composer 1.9.3 because it uses symfony/process 4.4.X, the same used by my app.
It was working well, but yesterday I have to bump the composer version to latest 1.X due to the Github OAuth token changes: https://nono.ma/github-oauth-token-for-github-com-contains-invalid-characters-on-composer-install
Issue
So, I'm still facing this issue with the 4.X version and the 5.X version.
I've tried to install the dependencies of my project this way : composer install -n -o -a but the bug still occurs.
I'm looking for a way to force my project to use the dependencies located in the vendor folder of my app and not the ones installed globally. Here is a screenshot of the issue on the Platform.sh server:
And here is a schema of the path of my app and composer on a Platform.sh server:
/app
|
|__/vendor/symfony-process
|
|__/.global/vendor/symfony-process
My composer.json:
{
"name": "oro/platform-application",
"description": "Oro Platform Empty Application",
"homepage": "https://github.com/oroinc/platform-application.git",
"license": "MIT",
"autoload": {
"psr-4": {
"": "src/"
},
"classmap": [
"src/AppKernel.php",
"src/AppCache.php",
"vendor/oro/platform/guzzle/Client.php"
],
"exclude-from-classmap": [
"/vendor/guzzle/guzzle/src/Guzzle/Http/Client.php",
"**/Tests/"
]
},
"repositories": {
"composer": {
"type": "composer",
"url": "https://packagist.orocrm.com"
}
},
"require": {
"php": "~7.3.13 || ~7.4.2",
"oro/platform": "4.1.*",
"oro/platform-serialised-fields": "4.1.*",
"oro/oauth2-server": "4.1.*",
"doctrine/doctrine-migrations-bundle": "^3.0"
},
"require-dev": {
"behat/behat": "3.4.*",
"behat/gherkin": "4.6.0",
"behat/mink": "dev-master#6d637f7af4816c26ad8a943da2e3f7eef1231bea",
"behat/mink-extension": "2.3.*",
"behat/mink-selenium2-driver": "1.3.1",
"behat/symfony2-extension": "2.1.*",
"guzzlehttp/guzzle": "^6.0.0",
"nelmio/alice": "3.6.*",
"theofidry/alice-data-fixtures": "1.0.*",
"phpunit/phpunit": "7.5.*",
"johnkary/phpunit-speedtrap": "3.0.*",
"mybuilder/phpunit-accelerator": "dev-master",
"squizlabs/php_codesniffer": "3.5.*",
"phpmd/phpmd": "2.6.*",
"sebastian/phpcpd": "4.0.*",
"phpunit/phpcov": "5.0.*",
"symfony/phpunit-bridge": "4.4.*",
"friendsofphp/php-cs-fixer": "2.16.*",
"oro/twig-inspector": "1.0.*"
},
"config": {
"component-dir": "public/bundles/components",
"bin-dir": "bin",
"fxp-asset": {
"enabled": false
}
},
"scripts": {
"post-install-cmd": [
"#build-parameters",
"#set-permissions",
"#install-assets",
"#set-assets-version"
],
"post-update-cmd": [
"#build-parameters",
"#set-permissions",
"#update-assets",
"#set-assets-version"
],
"build-parameters": [
"Incenteev\\ParameterHandler\\ScriptHandler::buildParameters"
],
"set-permissions": [
"Oro\\Bundle\\InstallerBundle\\Composer\\ScriptHandler::setPermissions"
],
"install-assets": [
"Oro\\Bundle\\InstallerBundle\\Composer\\ScriptHandler::installAssets"
],
"update-assets": [
"Oro\\Bundle\\InstallerBundle\\Composer\\ScriptHandler::updateAssets"
],
"set-assets-version": [
"Oro\\Bundle\\InstallerBundle\\Composer\\ScriptHandler::setAssetsVersion"
],
"set-parameters": [
"Oro\\Bundle\\InstallerBundle\\Composer\\ParametersHandler::set"
]
},
"minimum-stability": "dev",
"prefer-stable": true,
"extra": {
"symfony": {
"require": "4.4.*"
},
"symfony-web-dir": "public",
"symfony-var-dir": "var",
"symfony-bin-dir": "bin",
"symfony-tests-dir": "tests",
"incenteev-parameters": {
"file": "config/parameters.yml"
}
}
}

Answer 1

Finally I've supposed that installing composer under the same folder as the web application don't seems to be a good practise. Moreover, it seems that Platform.sh don't use the composer binary.
So, I have change the build phase inside my .platform.app.yaml to avoid the way Platform.sh install Composer and use a custom way to do it:
# .platform.app.yaml
hooks:
build: |
set -e
cd $PLATFORM_APP_DIR
# install Composer
chmod +x composer-install.sh
./composer-install.sh
# composer-install.sh
#!/bin/sh
EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]
then
>&2 echo 'ERROR: Invalid installer checksum'
rm composer-setup.php
exit 1
fi
php composer-setup.php --1 --quiet
RESULT=$?
rm composer-setup.php
>&1 echo 'Composer successfully installed'
exit $RESULT

Answer 2

Try installing the package, so it will be added to your composer.json file.
composer install symfony/process
The following section will cause the correct version to be installed
"extra": {
"symfony": {
"require": "4.4.*"
},
Once you've run the command, the package should be added as follows :
"symfony/process": "4.4.*"
If it does not, change it to that version number and run
composer update symfony/process