Composer install suddenly fails because of symfony/flex - symfony

Question

I'm having this problem out of the blue. I didn't change anything in composer and it ran just fine up until last week. Now when I run composer install I get this at the end:
Generating autoload files
ocramius/package-versions: Generating version class...
ocramius/package-versions: ...done generating version class
[ErrorException]
Undefined index: vulnerabilities
This makes my deploys crash and now I can't release anything on staging or production.
I've removed packages one by one and managed to trace the issue back to symfony/flex. I tried updating it, but composer just freezes on a random step that means nothing to me.
I've tried removing it and running a clean composer require symfony/flex in case there was a problem with my version - it installs it then tries to update dependencies and freezes forever.
I've tried:
composer clearcache
composer self-update
composer update --no-plugins --noscripts
Nothing works. It still freezes on update and still gives me the error on install. I am nearing desperation.
This is my composer.json file:
{
"type": "project",
"minimum-stability": "dev",
"prefer-stable": true,
"require": {
"php": "^7.1.3",
"ext-iconv": "*",
"ext-json": "*",
"ext-intl": "*",
"beberlei/doctrineextensions": "^1.2",
"brick/math": "0.7.*",
"doctrine/doctrine-bundle": "^1.12.6",
"dompdf/dompdf": "^0.8.2",
"fervo/enum-bundle": "^2.2",
"friendsofsymfony/jsrouting-bundle": "^2.1",
"friendsofsymfony/rest-bundle": "^2.0",
"friendsofsymfony/user-bundle": "^2.1.2",
"knplabs/knp-snappy-bundle": "^1.5",
"lexik/jwt-authentication-bundle": "^2.6",
"nelmio/api-doc-bundle": "^3.6",
"phpoffice/phpword": "^0.14.0",
"predis/predis": "^1.1",
"sc0vu/web3.php": "dev-master",
"sensio/framework-extra-bundle": "^5.1",
"sg/datatablesbundle": "v1.0.4",
"simplethings/entity-audit-bundle": "^1.0",
"snc/redis-bundle": "^2.0",
"sonata-project/admin-bundle": "^3.49",
"sonata-project/doctrine-orm-admin-bundle": "^3.4",
"sonata-project/easy-extends-bundle": "^2.5",
"sonata-project/user-bundle": "^4.1",
"symfony/asset": "^4.0",
"symfony/console": "^4.0",
"symfony/debug-pack": "*",
"symfony/expression-language": "^4.0",
"symfony/flex": "v1.1",
"symfony/form": "^4.0",
"symfony/framework-bundle": "^4.0",
"symfony/monolog-bundle": "^3.1",
"symfony/orm-pack": "^1.0",
"symfony/process": "^4.0",
"symfony/security": "^4.0",
"symfony/security-bundle": "^4.0",
"symfony/security-csrf": "^v4.0",
"symfony/serializer-pack": "*",
"symfony/swiftmailer-bundle": "^3.1",
"symfony/translation": "^4.0",
"symfony/validator": "^4.0",
"symfony/web-link": "^4.0",
"symfony/webpack-encore-pack": "^1.0",
"symfony/yaml": "^4.0",
"twilio/sdk": "^5.0",
"web3p/ethereum-tx": "^0.3.4",
"willdurand/js-translation-bundle": "2.6.6"
},
"require-dev": {
"ext-json": "*",
"behat/symfony2-extension": "^2.1.5",
"doctrine/data-fixtures": "^1.3",
"hautelook/alice-bundle": "^2.0",
"phpmd/phpmd": "^2.6",
"phpstan/phpstan": "^0.10.6",
"squizlabs/php_codesniffer": "^3.3",
"symfony/browser-kit": "^4.0",
"symfony/css-selector": "^4.0",
"symfony/dotenv": "^4.0",
"symfony/maker-bundle": "^1.0",
"symfony/phpunit-bridge": "~4.3.0",
"symfony/profiler-pack": "*",
"zitec/behat-extension": "dev-master#dev"
},
"config": {
"preferred-install": {
"*": "dist"
},
"sort-packages": true
},
"autoload": {
"psr-4": {
"App\\": "src/"
}
},
"autoload-dev": {
"psr-4": {
"App\\Tests\\": ["tests/functional", "test/unit", "tests/api"]
}
},
"replace": {
"symfony/polyfill-iconv": "*",
"symfony/polyfill-php71": "*",
"symfony/polyfill-php70": "*",
"symfony/polyfill-php56": "*"
},
"scripts": {
"auto-scripts": {
"cache:clear": "symfony-cmd",
"cache:warmup": "symfony-cmd",
"assets:install --symlink --relative %PUBLIC_DIR%": "symfony-cmd"
},
"post-install-cmd": [
"#auto-scripts"
],
"post-update-cmd": [
"#auto-scripts"
]
},
"conflict": {
"symfony/symfony": "*"
},
"extra": {
"symfony": {
"id": "04C3GOB2A6BKEGTJ93E6RLD8R5",
"allow-contrib": true
}
}
}
My composer version is 1.10.22
composer update --vvv freezes after these lines:
Downloading http://repo.packagist.org/p/athletic/athletic%247c468034c468fcf26e08cb4c4e42c29c6058991f243753f391bf4be1a93476f1.json
Writing /root/.composer/cache/repo/https---repo.packagist.org/provider-athletic$athletic.json into cache
Downloading http://repo.packagist.org/p/laminas/laminas-stdlib%243063fe25485f2f11f7dcdae0d6592d8c4740bd0e4c6fbf5fac7141542cc10d34.json
Writing /root/.composer/cache/repo/https---repo.packagist.org/provider-laminas$laminas-stdlib.json into cache
Downloading http://repo.packagist.org/p/zendframework/zend-hydrator%24929a25c4d947fc57e2c18901b036ca54a167be6e1ac3b7a7ebc22757a91784a3.json
Writing /root/.composer/cache/repo/https---repo.packagist.org/provider-zendframework$zend-hydrator.json into cache
Downloading http://repo.packagist.org/p/laminas/laminas-hydrator%24a55a80ba78a25b92b6156070846ea5bcd90dfa7fc7c51c707f62695d865e56ab.json
Writing /root/.composer/cache/repo/https---repo.packagist.org/provider-laminas$laminas-hydrator.json into cache
Does anyone have any clue what might be causing this or what else I could try? Lots of please and many thanks!

Answer 1

Had same issue with v1.1.8 of symfony/flex updated it to v1.17.2 and problem was solved.
To update it just run:
composer update symfony/flex