search

magento / composer-dependency-version-audit-plugin

validating packages through a composer plugin
Open Software License 3.0
4 stars 8 forks source link

Is there any benefit to this plugin when using Composer 2.x ? #6

Open fooman opened 2 years ago

fooman commented 2 years ago

I believe this plugin's aim is to guard against unintentional switching of the repository source.

Composer 2.0 uses canonical repository order by default - see https://getcomposer.org/doc/articles/repository-priorities.md#canonical-repositories this prevents unintentional switching of repositories.

Given the above and the implication of this plugin in issues like https://github.com/magento/magento2/issues/34325#issuecomment-942231971 can someone please confirm if there is any benefit of this plugin above what Composer 2.0 does? If there is none I would propose to make this plugin a No-Op on Composer 2.0 (and subsequent removal once only Composer 2.0 is supported) and keeping the functionality when using Composer 1.0.

gabrieldagama commented 1 year ago

Hi @admanesachin @nathanjosiah we have the same question regarding this plugin. Is this still recommended to be used with composer 2? Thanks!