After running composer install two extensions had been removed from PackageStates.php: simulatebe and fe_change_pwd.
> typo3cms install:generatepackagestates The following extensions have been added to the generated PackageStates.php file: core, scheduler, extbase, fluid, frontend, fluid_styled_content, install, info, linkvalidator, reports, redirects, recordlist, backend, recycler, belog, beuser, extensionmanager, felogin, filelist, lowlevel, rte_ckeditor, seo, sys_note, t3editor, tstemplate, viewpage, addons_em, static_info_tables, static_info_tables_de, flux, vhs, ce_timeline, func, masi, pxa_lpeh, sentry_client, t3adminer, typo3db_legacy
composer list said both were installed.
The folder of those extensions were nearly empty, and I had to reinstall them:
$ composer2 reinstall derhansen/fe_change_pwd Gathering patches for root package. - Removing derhansen/fe_change_pwd (2.0.4) - Downloading derhansen/fe_change_pwd (2.0.4) Gathering patches for root package. Gathering patches for dependencies. This might take a minute. - Installing derhansen/fe_change_pwd (2.0.4): Extracting archive $ composer2 reinstall cabag/simulatebe Gathering patches for root package. - Removing cabag/simulatebe (10.4.0) - Downloading cabag/simulatebe (10.4.0) Gathering patches for root package. Gathering patches for dependencies. This might take a minute. - Installing cabag/simulatebe (10.4.0): Extracting archive $ composer2 install .. correct package states were generated