search

cedaro / satispress

Expose installed WordPress plugins and themes as Composer packages.
508 stars 51 forks source link

Archived plugin from URL – higher version than installed #137

Closed BrianHenryIE closed 3 years ago

BrianHenryIE commented 3 years ago

Hey,

I just saw in the logs:

SATISPRESS.INFO: Archived PixelYourSite Pinterest 2.0.16 from URL.

We only have 2.0.15 installed. It's an EDD plugin which I can download the 2.0.16 from their site but it hasn't been offered via WordPress native plugin updater.

The problem I foresee, is if I have "satispress/pixelyoursite-pinterest": "*", in my composer.json and update, I'll have a different version on my local machine, make changes to it, upload it, and potentially break things.

So I gather SatisPress is running it's own plugin updater. I think a prudent default is to only archive versions that have been in use on the site. I see where making then next version available could be useful, but it was unexpected.

Storytime: I used SatisPress to download that plugin to fix a bug in it then submitted the fix to the developers. This new release does not contain the bugfix I sent them!

bradyvercher commented 3 years ago

Hey @BrianHenryIE, there are various ways to use SatisPress, but it sounds like this is the intended behavior. Releases are archived as soon as they're made available to WordPress, so even if you're running an earlier to release, newer versions should still be cached and available through Composer.

I might be misunderstanding what exactly happened here, but SatisPress doesn't run its own update routine, so if version 2.0.16 was archived from URL then it was likely made available to the WordPress native plugin updater at some point.

SatisPress is just a repository for making packages available to Composer (multiple sites can connect to any given SatisPress repository). It shouldn't be used for managing version constraints in a single project. That should be done in composer.json. I'd recommend using something more restrictive than * if you don't want the most recent version to be installed. Also, if you fork a package to make a bug fix and don't want that to be overridden by Composer, you'll need to update composer.json to prevent that from happening.