Using the Drupal Lenient Composer Plugin

Since Drupal 9, there are many projects on Drupal.org that are compatible with an older version of Drupal, but are not yet compatible with a newer version. Many of these projects have patches available to make them compatible, but the maintainers have not committed them. Both of the following need to be possible to be able to use these projects:

1. Composer to download the project code
2. Patches applied to make the code compatible

Typically, site owners would download a project and then patch it to make it compatible, however, https://packages.drupal.org/8 advertises these projects as only being compatible with the earlier version of Drupal, which prevents composer from downloading the project into a codebase with a newer version of Drupal, which in turn prevents them from being patched. So patching alone is not enough; a solution is needed to get around the version constraints which are read from this remote endpoint.

Drupal Lenient Composer Plugin

The Drupal Lenient Composer Plugin lets you specify an allowlist of packages where you are willing to break the version constraints, when updating from Drupal 9 or Drupal 10 to Drupal 11.

Install like this, press y at the allow-plugins prompt:
composer require mglaman/composer-drupal-lenient

Lenient a single module

Ignore version constraints for a module, add with this command:
composer config --merge --json extra.drupal-lenient.allowed-list '["drupal/simplenews"]'

Lenient all projects

If you want to allow all packages to have a lenient Drupal core version constraint, you can set extra.drupal-lenient.allow-all to true:
composer config --json extra.drupal-lenient.allow-all true

Using allow-all allows you to install any package without needing to add it to the allowed-list.

Allow installation

For a quick start, allow installing the module by installing Backward Compatibility:

Backward Compatibility allows you to install old Drupal modules in current Drupal.

Alternatively, manually add the latest version in the module *.info.yml file:
core_version_requirement: ^9.3 || ^10 || ^11

Together with the Composer Patches Plugin, this allows you to install any Drupal extension, even if the version constraint hasn't been officially updated yet. Of course the code may still need to be patched for deprecations. 

Note, when using DrupalPod, first run ddev ssh before the composer config command above, or manually update the allowed-list in thecomposer.json file directly.

Former lenient Composer endpoint

Drupal.org offered a second composer repository endpoint: https://packages.drupal.org/lenient which is no longer available.

If your composer.json contains the following in the repositories section, it can safely be removed.

        "lenient": {
            "type": "composer",
            "url": "https://packages.drupal.org/lenient"
        },