`php-http/discovery` dependency

[brendt]

Every time you create a new Tempest project, you have to manually confirm that php-http/discovery is an allowed plugin. Is there a way to either get rid of this dependency, or skip the message?

[aidan-casey]

I'll have a fix for this today. 🙂

[aidan-casey]

@brendt - I'm actually having a hard time replicating this. Can you give me the steps you took to get this message?

[brendt]

I get it whenever I install tempest in a new project. Maybe you've got composer configured in a way that it remembers it?

[brendt]

In an empty folder:

composer init -ns dev
composer require tempest/framework:dev-main

Then you'll get

php-http/discovery contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "php-http/discovery" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] 

[aidan-casey]

Ah... interesting. I was using create-project and not getting it. Following these instructions, I get it.

[Treggats]

@brendt @aidan-casey

We have the following in our composer.json With which we don't have to accept it every time

 "config": {
        "platform": {
            "php": "8.3.0"
        },
        "preferred-install": "dist",
        "secure-http": false,
        "sort-packages": true,
        "optimize-autoloader": true,
        "classmap-authoritative": false,
        "allow-plugins": {
            "php-http/discovery": true,
            "phpstan/extension-installer": true
        }
    },

[aidan-casey]

@Treggats if you check the framework composer, I had added this as well. The question is why it is prompting when following the steps @brendt gave.

[aidan-casey]

So what's happening is it needs to be in the root project directory composer. Naturally with create-project it would be since we have control over that template, but it won't be when requiring into an existing project.

I'll look into what we can do with that dependency.

[brendt]

FWIW, I rather ditch the dependency and have people require it manually if they need it (which from what I understand, not many people will)

[brendt]

I removed it for now.