Now, I use commit-ref in our composer.json to that commit/fix in order to make SA, but composer validate treats it as a security issue:
composer validate --no-check-all --strict
./composer.json is valid, but with a few warnings
See https://getcomposer.org/doc/04-schema.md for details on the schema
# General warnings
- The package "burtds/laravel-vatnumber-checker" is pointing to a commit-ref, this is bad practice and can cause unforeseen issues.
Can we please release existing changes as a new patch release?
On my project I have pretty advanced CI/CD scripts with static analysis and
composer validate --no-check-all --strict
command.To pass static analyses, I created https://github.com/BurtDS/laravel-vatnumber-checker/pull/4
Now, I use commit-ref in our composer.json to that commit/fix in order to make SA, but composer validate treats it as a security issue:
Can we please release existing changes as a new patch release?