Drop the Composer 1 default branch fallback from download tracking

src/Controller/ApiController.php

@@ -305,15 +305,6 @@ public function trackDownloadsAction(Request $request, StatsDClient $statsd, str
         ];
         $jobs = $failed = [];
         foreach ($payload as $package) {
-            // support legacy composer v1 normalized default branches
-            if ($package['version'] === '9999999-dev' && !isset($package['id'], $package['vid'])) {
-                $result = $this->getDefaultPackageAndVersionId($package['name']);
-                if ($result) {
-                    $package['id'] = $result['id'];
-                    $package['vid'] = $result['vid'];
-                }
-            }
-
             if (!isset($package['id'], $package['vid'])) {
                 $failed[] = $package;
                 continue;
@@ -434,29 +425,6 @@ public function securityAdvisoryAction(Request $request, ProviderManager $provid
         return new JsonResponse($response, 200);
     }
 
-    /**
-     * @return array{id: int, vid: int}|false
-     */
-    protected function getDefaultPackageAndVersionId(string $name): array|false
-    {
-        /** @var array{id: string, vid: string}|false $result */
-        $result = $this->getEM()->getConnection()->fetchAssociative(
-            'SELECT p.id, v.id vid
-            FROM package p
-            LEFT JOIN package_version v ON p.id = v.package_id
-            WHERE p.name = ?
-            AND v.defaultBranch = true
-            LIMIT 1',
-            [$name]
-        );
-
-        if (false === $result) {
-            return false;
-        }
-
-        return ['id' => (int) $result['id'], 'vid' => (int) $result['vid']];
-    }
-
     /**
      * Perform the package update
      *

tests/Controller/ApiControllerTest.php

@@ -16,6 +16,7 @@
 use App\SecurityAdvisory\GitHubSecurityAdvisoriesSource;
 use App\SecurityAdvisory\RemoteSecurityAdvisory;
 use App\SecurityAdvisory\Severity;
+use App\Model\VersionIdCache;
 use App\Tests\IntegrationTestCase;
 use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\Attributes\Depends;
@@ -330,4 +331,55 @@ public function testComposerVersionsReturns502OnUpstreamFailure(): void
         $this->assertSame(502, $response->getStatusCode());
         $this->assertJsonStringEqualsJsonString('{"status":"error","message":"Failed to fetch upstream version data, please try again later."}', (string) $response->getContent());
     }
+
+    public function testTrackDownloadsCountsAResolvableVersion(): void
+    {
+        $package = self::createPackage('test/pkg', 'https://example.org/pkg');
+        $this->store($package);
+
+        // the endpoint resolves name+version to ids straight out of Redis, never MySQL
+        self::getService(VersionIdCache::class)->insertVersionRaw($package->getId(), 'test/pkg', 4242, '1.0.0.0');
+
+        $this->client->request(
+            'POST',
+            '/downloads/',
+            server: ['HTTP_USER_AGENT' => 'Composer/2.8.0 (Linux; 6.1.0; PHP 8.4.0; curl 8.5)'],
+            content: json_encode(['downloads' => [['name' => 'test/pkg', 'version' => '1.0.0.0']]], flags: \JSON_THROW_ON_ERROR),
+        );
+
+        self::assertResponseStatusCodeSame(201);
+        self::assertSame(['status' => 'success'], $this->decodeResponse());
+    }
+
+    public function testTrackDownloadsReportsUnresolvableVersionsAsPartial(): void
+    {
+        $package = self::createPackage('test/pkg', 'https://example.org/pkg');
+        $this->store($package);
+
+        // Composer 1 sent the default branch as 9999999-dev. Support for it was shut down on
+        // 2025-09-01 and there is no longer a MySQL fallback resolving it via defaultBranch, so an
+        // unknown version is reported back like any other.
+        $this->client->request(
+            'POST',
+            '/downloads/',
+            server: ['HTTP_USER_AGENT' => 'Composer/1.10.26 (Linux; 6.1.0; PHP 8.4.0; curl 8.5)'],
+            content: json_encode(['downloads' => [['name' => 'test/pkg', 'version' => '9999999-dev']]], flags: \JSON_THROW_ON_ERROR),
+        );
+
+        self::assertResponseStatusCodeSame(200);
+        $body = $this->decodeResponse();
+        self::assertSame('partial', $body['status']);
+        self::assertStringContainsString('9999999-dev', $body['message'], 'the unresolved entry is reported back to the client');
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function decodeResponse(): array
+    {
+        $body = json_decode((string) $this->client->getResponse()->getContent(), true, flags: \JSON_THROW_ON_ERROR);
+        self::assertIsArray($body);
+
+        return $body;
+    }
 }