After running composer install two extensions had been removed from PackageStates.php: simulatebe and fe_change_pwd.
> typo3cms install:generatepackagestates The following extensions have been added to the generated PackageStates.php file: core, scheduler, extbase, fluid, frontend, fluid_styled_content, install, info, linkvalidator, reports, redirects, recordlist, backend, recycler, belog, beuser, extensionmanager, felogin, filelist, lowlevel, rte_ckeditor, seo, sys_note, t3editor, tstemplate, viewpage, addons_em, static_info_tables, static_info_tables_de, flux, vhs, ce_timeline, func, masi, pxa_lpeh, sentry_client, t3adminer, typo3db_legacy
composer list said both were installed.
The folder of those extensions were nearly empty, and I had to reinstall them:
$ composer2 reinstall derhansen/fe_change_pwd Gathering patches for root package.
- Removing derhansen/fe_change_pwd (2.0.4)
- Downloading derhansen/fe_change_pwd (2.0.4)
Gathering patches for root package. Gathering patches for dependencies. This might take a minute.
- Installing derhansen/fe_change_pwd (2.0.4): Extracting archive
$ composer2 reinstall cabag/simulatebe Gathering patches for root package.
- Removing cabag/simulatebe (10.4.0)
- Downloading cabag/simulatebe (10.4.0)
Gathering patches for root package. Gathering patches for dependencies. This might take a minute.
- Installing cabag/simulatebe (10.4.0): Extracting archive
$ composer2 install .. correct package states were generated