magento / magento/composer-dependency-version-audit-plugin
Third-Party Extension Subscriptions Causing Issues
- Dominant language
- PHP
- Stars
- 5
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
When using a third-party extension from a vendor that utilizes the subscription model, it appears that some vendors may lock access to updated versions of dependencies that are otherwise released publicly (e.g. [amasty/module-mage-2.4.5-fix](https://packagist.org/packages/amasty/module-mage-2.4.5-fix)). This causes the Packagist version to be newer than the locked version available from the vendor.
This is effectively the same issue as reported here and in other repositories:
- #6
- #7
- AmpersandHQ/travis-vanilla-magento#27
- fooman/sameorderinvoicenumber-implementation-m2#3
Some simple solutions that may work around this particular issue are:
1. Remove the dependency on the `magento/composer-dependency-version-audit-plugin`
1. Filter the packages available via a particular repository
- This could become a maintenance nightmare
1. Renew your subscription to the vendor
Contributor guide
Research direction
Start by reviewing the dependency-version behavior described for amasty/module-mage-2.4.5-fix and comparing the related issues #6, #7, AmpersandHQ/travis-vanilla-magento#27, and fooman/sameorderinvoicenumber-implementation-m2#3. Done would require an agreed solution for handling vendor-locked dependencies, but this issue does not identify a file, test, or settled implementation path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100