magento / magento/composer-dependency-version-audit-plugin

Third-Party Extension Subscriptions Causing Issues

Open
#8 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
5
Forks
7
PR merge metrics
No merged PRs in 30d

Description

When using a third-party extension from a vendor that utilizes the subscription model, it appears that some vendors may lock access to updated versions of dependencies that are otherwise released publicly (e.g. [amasty/module-mage-2.4.5-fix](https://packagist.org/packages/amasty/module-mage-2.4.5-fix)). This causes the Packagist version to be newer than the locked version available from the vendor.

This is effectively the same issue as reported here and in other repositories:
- #6
- #7
- AmpersandHQ/travis-vanilla-magento#27
- fooman/sameorderinvoicenumber-implementation-m2#3

Some simple solutions that may work around this particular issue are:

1. Remove the dependency on the `magento/composer-dependency-version-audit-plugin`
1. Filter the packages available via a particular repository
- This could become a maintenance nightmare
1. Renew your subscription to the vendor

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the dependency-version behavior described for amasty/module-mage-2.4.5-fix and comparing the related issues #6, #7, AmpersandHQ/travis-vanilla-magento#27, and fooman/sameorderinvoicenumber-implementation-m2#3. Done would require an agreed solution for handling vendor-locked dependencies, but this issue does not identify a file, test, or settled implementation path.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
tooling
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.