docs: git is no longer an alternative to unzip since Composer 2.10

[CybotTM]

PR submitter checklist

• I have read CONTRIBUTING.md
• I discussed this <bug|feature> with the maintainers in #<issue_number> (complete as appropriate)
• I have added appropriate tests
• I confirm that I have the right to submit this under the project's open source licence

docs/usage.md states the Docker requirement as "unzip, the Zip extension, or git". The third option no longer works, and the failure it produces points at zip rather than at git, so it is hard to trace back to this sentence.

Composer 2.10 removed the automatic fallback from a failed dist extraction to a source checkout: "BC Break / Security: Disabled automatic fallback to source checkout if dist/zip install fails" (composer/composer#12885). PIE has shipped Composer 2.10 since 1.4.8 (composer/composer 2.9.8 in 1.4.7, 2.10.2 in 1.4.8, #663). In an image that only has git, pie install used to work:

Failed to download pecl/pcov from dist: The zip extension and unzip/7z commands are both missing, skipping.
Now trying to download from source
- Installing pecl/pcov (v1.0.12): Cloning e16c08e14d from cache

and now aborts:

Failed to download pecl/pcov from dist: The zip extension and unzip/7z commands are both missing, skipping.
Source fallback is disabled. Not trying alternative sources.
In ZipDownloader.php line 81: The zip extension and unzip/7z commands are both missing, skipping.

What I verified

Each case is pie install pecl/pcov on php:8.4-trixie, differing only in what is installed:

image contents	result
unzip, no git	installs
ext-zip, no unzip, no git	installs
git, no unzip, no ext-zip — PIE 1.4.7	installs, via source checkout
git, no unzip, no ext-zip — PIE 1.4.8 / 1.4.9	fails

Bisected across ghcr.io/php/pie:<version>-bin: 1.4.3 through 1.4.7 install, 1.4.8 and 1.4.9 do not.

The note keeps git rather than dropping it, because it is still required where Composer talks to a repository over git. Same image, same commands, only git differing:

• without git: No driver found to handle VCS repository /extrepo
• with git: the Git driver is selected (it proceeds to git's own detected dubious ownership check)

Branch

Opened against 1.4.x as the oldest affected branch, per the branching strategy in the maintainers handbook — 1.3.x still ships Composer 2.9.8, where the current wording is still correct. 1.5.x carries the same sentence and needs the same change.

Notes

• CONTRIBUTING.md asks for an issue before code changes. This is a documentation correction with the evidence inline, so it comes as a PR directly — happy to move it to an issue first if you prefer.
• The ja and zh translations carry the same sentence and are updated to match. A native speaker should sanity-check the wording; the technical content mirrors the English note.

---

Assisted by claude-code:claude-opus-5 — Session