search

hirak / prestissimo

composer parallel install plugin
MIT License
6.18k stars 170 forks source link

GitHub deprecated query param authentication #210

Closed andytson-inviqa closed 4 years ago

andytson-inviqa commented 4 years ago

Github has deprecated query parameter authentication (?access_token=....)

https://developer.github.com/changes/2019-11-05-deprecated-passwords-and-authorizations-api/#authenticating-using-query-parameters

This appears to be still be used in this composer plugin, which is causing Github to notify via email all Github accounts being used by this plugin.

This will need a change to use Authorization: token (or basic) authentication to continue beyond obsoletion, and to stop the Github email notifications being sent.

The lines of code which are doing this appear to be at: https://github.com/hirak/prestissimo/blob/4c52352f4bc88bbf9063e18ee94016faadde88c5/src/BaseRequest.php#L143-L148

There was some confusion in https://github.com/composer/composer/issues/8586 as to the cause, when composer itself had fixed it in 1.9.3.

trentza commented 4 years ago

added a PR https://github.com/hirak/prestissimo/pull/212 but @andytson-inviqa has tests with his fix.

andytson commented 4 years ago

release 0.3.10 contains the fix for this now

hirak commented 4 years ago

Sorry for the late reply. As already commented, please try 0.3.10.

archon810 commented 4 years ago

If I already have this installed, how does one update to 0.3.10? README doesn't mention updating - only installing. I know I can remove and reinstall, but updating would be easier.

Edit: Looks like running composer.phar global require hirak/prestissimo again does the update.