[4.x]: Built in updater does not use authentication for private composer repos

[rob-baker-ar]

What happened?

Description

Have an auth.json file set-up according to the docs.

When using: craft update all composer tries to download from the private repository (as defined in composer.json under the 'repositories' key (link) ) and cannot due to an authentication error:

error: The "https://[private-repo-host]/.../packages.json" file could not be downloaded

However if composer is used directly composer update, everything works as it should. It seems as if the auth.json file is not being seen or used by Craft's internal updater.

Craft CMS version

4.4.14

PHP version

8.1.2

Operating system and version

N/A

Database type and version

N/A

Image driver and version

N/A

Installed plugins and versions

Any set of plugins but crucially, with a package loaded from a private composer repository.

Craft's internal composer version: 2.2.19 Composer version installed globally: 2.3.5 (i.e. when using composer directly)

However, support has existed for the auth.json back to composer 1.x.

[Mactory]

I have the same problem. If I put the auth.json in ~/.config/composer/ it does work. So only the local auth.json is ignored

[rob-baker-ar]

I have mostly stopped using Craft's own composer in favour of a manually installed global version, but that's a helpful work-around, thanks!