Composer using old JSON for contrib module? I maintain skilling, a contrib module. This...

composer require drupal/skilling


... reports...

[RuntimeException]
  Could not load package drupal/skilling in https://packages.drupal.org/8: [UnexpectedValueException] Could not parse version constraint ~1.0@alpha2: Invalid version string "~1.0@alpha2"

[UnexpectedValueException]
  Could not parse version constraint ~1.0@alpha2: Invalid version string "~1.0@alpha2"

An older version of composer.json did use the string "~1.0@alpha2", but it was removed a while ago. Download the module's zip from D.O, and there is no such string in the file set once the zip file is expanded.

BTW, use the zip file, or Git the source files into contrib/modules, and Drupal installs everything just fine. It's just the composer install that's the problem.

I tried composer clearcache, but no dice. Using -vvv on 'composer require' didn't give me any info that I could interpret. Looking at composer's cache shows Strange Things. The file $skilling.json refers to the right release, but has '"drupal/token_custom":"~1.0@alpha2"' from long ago.

Help appreciated! The module can't be installed with Composer at the moment.

----- Update ARGH!! ----

@Clive is probably right, but I don't know how to fix it. Tried removing the line with the bad Composer version string in Git history with:

git filter-branch -f --tree-filter 'sed -i "/drupal\/token\_custom/d" composer.json' -- --all


Also tried BFG repo rewrite tool to replace the bad string.

Pushed. Created new releases. Cleared composer cache. composer require generates the same errors.

Afraid I don't understand Clive's suggestion to rebase a fix onto the branch containing the invalid version string. How is that done?
Im the maintainer of packages.drupal.org - I went ahead and deleted the invalid data out of the database, and this will install now.

I've also opened and issue on drupal.org to put more defensive measures in place. https://www.drupal.org/project/project_composer/issues/3076342

I think something must have changed in how permissive composer is with certain bad version constraints.