Problem/Motivation
Upgrading a Composer plugin can be an error-prone operation. If the Plugin class instantiates objects (or, more specifically, loads classes) in the `activate` method (or any pre-command hook), and those classes are updated as part of a `composer update` operation, then the old version of the code loaded in `activate` will continue to be used in the post-update hooks, whereas in contrast, classes loaded after the update will be loaded from the new code. This can cause old versions of the classes that were pre-loaded attempt to use methods that no longer exist, e.g. if things are removed. If new versions of the classes have references back to the older (pre-loaded) classes, then errors could be thrown if methods that did not previously exist are called.
Proposed resolution
In the Scaffold plugin, avoid instantiating objects in the `activate` hook, and add a test that confirms whether an upgrade from the Scaffold plugin version 8.8.0 to the current code under test (e.g. in the current patch) works.
The ProjectMessage plugin is already written in a way that makes it resilient against changes. Consider opening a follow-on issue to add a test protecting ProjectMessage from future changes that might alter this.
The VendorHardening plugin has both pre and post hooks, so it would be difficult to protect it by lazy-loading objects. There are not many objects in this plugin, though, so it might be possible to protect it by pre-loading all classes in `activate`. The objects that exist have a simple API, though, so it is less likely that they will need to change. Consider opening a follow-on issue to add a test protecting VendorHardening from future changes that might alter this.
Remaining tasks
Not sure.
User interface changes
None.
API changes
None.
Data model changes
None.
Release notes snippet
Probably not needed.