Thank you.

You may have to adjust our release script, it may lack quotes maybe
https://github.com/phpmyadmin/phpmyadmin/actions/runs/17361010383/job/49281102489?pr=19837#step:11:615

For some reason locally the command composer require --dev bacon/bacon-qr-code:"^2.0 || ^3.0" pragmarx/google2fa-qrcode:^2.1 works fine

a9bc83c was maybe a good idea

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.68%. Comparing base (b96856d) to head (238d18b).
⚠️ Report is 9 commits behind head on QA_5_2.

@@             Coverage Diff              @@
##             QA_5_2   #19837      +/-   ##
============================================
+ Coverage     49.44%   50.68%   +1.23%     
- Complexity    16778    16779       +1     
============================================
  Files           607      607              
  Lines         69485    69488       +3     
============================================
+ Hits          34357    35219     +862     
+ Misses        35128    34269     -859     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

This seems to work. Setting the input separator to a newline character and separating each package by a new line

for PACKAGE in $PACKAGE_LIST
do
    PKG_VERSION="$(get_composer_package_version "$PACKAGE")"
    PACKAGES_VERSIONS="$PACKAGES_VERSIONS\n$PACKAGE:$PKG_VERSION"
done

echo "* Installing composer packages '$(echo "$PACKAGES_VERSIONS" | tr $'\n' ' ')'"
IFS=$'\n' composer require --no-interaction --update-no-dev $PACKAGES_VERSION

@williamdes all versions worked locally, but I must admit that I have the latest version of composer.

Test seems to pass https://github.com/phpmyadmin/phpmyadmin/actions/runs/17363513269/job/49286783009. Let me know which version you prefer the one that is right now or @MoonE approach.

@williamdes all versions worked locally, but I must admit that I have the latest version of composer.

Test seems to pass https://github.com/phpmyadmin/phpmyadmin/actions/runs/17363513269/job/49286783009. Let me know which version you prefer the one that is right now or @MoonE approach.

I think the IFS option by @MoonE is more standard bash than yours
Maybe take it in your PR with a Co-Author line

Something is not working as expected, I am confused

Only 238d18b worked.

Maybe this will work?

NEWLINE=$'\n'
for PACKAGE in $PACKAGE_LIST
do
    PKG_VERSION="$(get_composer_package_version "$PACKAGE")"
    PACKAGES_VERSIONS="${PACKAGES_VERSIONS}${NEWLINE}${PACKAGE}:${PKG_VERSION}"
done

echo "* Installing composer packages '$(echo "$PACKAGES_VERSIONS" | tr $NEWLINE ' ')'"
IFS=$NEWLINE composer require --no-interaction --update-no-dev $PACKAGES_VERSIONS

238d18b is the way to go with the dash shell, the default shell for #!/bin/sh on Ubuntu.
But maybe change this:

-echo "* Installing composer packages '$@'"
+echo "* Installing composer packages '$*'"

https://www.shellcheck.net/wiki/SC2145

But maybe change this:

Done. Output looks OK. https://github.com/phpmyadmin/phpmyadmin/actions/runs/17388649338/job/49358987203?pr=19837