magento / magento/composer-dependency-version-audit-plugin
Is there any benefit to this plugin when using Composer 2.x ?
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 5
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
I believe this plugin's aim is to guard against unintentional switching of the repository source.
Composer 2.0 uses canonical repository order by default - see https://getcomposer.org/doc/articles/repository-priorities.md#canonical-repositories
this prevents unintentional switching of repositories.
Given the above and the implication of this plugin in issues like https://github.com/magento/magento2/issues/34325#issuecomment-942231971 can someone please confirm if there is any benefit of this plugin above what Composer 2.0 does? If there is none I would propose to make this plugin a No-Op on Composer 2.0 (and subsequent removal once only Composer 2.0 is supported) and keeping the functionality when using Composer 1.0.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Composer repository priorities documentation linked in the issue and the referenced Magento issue comment. Determine whether Composer 2's canonical repository behavior fully overlaps with this plugin, then decide whether a Composer 2 no-op and eventual removal are appropriate while retaining Composer 1 support. Done requires a documented decision and an agreed implementation scope.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100