Closed LocalHeroPro closed 2 years ago
@LocalHeroPro It's perfectly safe to allow this. Once you do, the approval will be added to your composer.json
and (as long as you commit the change), you won't asked again.
This has to do with the new version of Composer which was released yesterday, please see the release announcement here: https://blog.packagist.com/composer-2-2/#more-secure-plugin-execution
A PR to update the readme with information about this is already open: #141
Hi! TL;DR: It is safe to allow.
This is a new feature in Composer 2.2, meant to make plugin execution more secure.
The new
allow-plugins
config value enhances security for Composer runtime plugin execution. Composer will now prompt you the first time you use a plugin to be sure that no package can run code during a Composer run if you do not trust it.
see https://blog.packagist.com/composer-2-2/#more-secure-plugin-execution
As this plugin is meant to be run by Composer, you should select y
, to indicate you trust our code to run.
If you do not know whether you can trust our code, review the source code to verify nothing malicious is going on.
(either the online version or your local version in vendor/dealerdirect/phpcodesniffer-composer-installer/src/Plugin.php
).
An update to our documentation has been made in #141 which to help explain this to users.
@jrfnl Looks like you just beat me to the punch. :smile_cat:
@Potherca I love our timing (posting a reply the same moment) 😂
Closing as #141 has been merged.
Reproduce
Is safe to allow or is some how to resolve that warning?