"composer install" needs to be called twice when a dependency adds a patch

[prudloff-insite]

Say we have a package A that declares patches for package B.

If we install a new version of package A that contains new patches for package B, here is what happens when we deploy on our CI:

• At the first composer install, the new version of package A is installed but no new patch is applied.
• If we launch composer install again, the new patches are applied to package B.

I suppose this happens because the patches are collected before the package is updated.

[briantschu]

I was experiencing this issue on 1.7.0 but updating this package to 1.7.1 resolved it!

[prudloff-insite]

We were indeed using 1.7.0. I tried using 1.7.1 but I can still reproduce the issue.

[cweagans]

This doesn't happen in main anymore.

[prudloff-insite]

I can still reproduce with 37e1b296d8100845c7b10c143cc3e96552d41ab1 (and Composer 2.3.10).

How I reproduce:

1. Pull a commit that contains composer.lock changes updating a package that declares patches. The package has updated some of its packages since the latest release.
2. Call composer install: the module is installed but does not update the patches it declares.
3. Call composer install again: now the patches are applied