Roave / SecurityAdvisories

:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily
MIT License
2.72k stars 106 forks source link

force install as dev-requirement #110

Closed jkowalleck closed 1 year ago

jkowalleck commented 1 year ago

Composer has a mechanism to allow a package to enforce to be a dev-requirement, rather than a non-dev-requirement

read https://getcomposer.org/doc/04-schema.md#keywords

Some special keywords trigger composer require without the --dev option to prompt users if they would like to add these packages to require-dev instead of require. These are: dev, testing, static analysis.

All documentation of this project state that this is should be a dev-requirement. Let's enforce it. I propose to add the keyword dev to the manifest composer.json.

jkowalleck commented 1 year ago

see: https://github.com/Roave/SecurityAdvisoriesBuilder/pull/730