WordPress Core Update Overwrites Plugins Installed by Composer

[ChexWarrior]

Hi,

I have been attempting to update my WordPress sites on Wodby from 4.9.5 to 4.9.6, however each time I do this all of the packages (that is plugins) installed by composer are removed. I believe the reason this is occurring is that I've set my plugins to install within the web/wp-content/plugins directory which is within the WordPress core installation path web. When composer updates it sees that my plugins are up to date and then updates core which removes everything in the web directory and replaces it with the updated files, however this does not include the packages that were previously installed.

I have a workaround which is to add the entire web/wp-content/plugins directory into the preserve-paths array, however this means that whatever was originally in that directory will overwrite whatever was added by a core update. So far I haven't noticed any ill effects, however I'm going to keep testing to make sure of this.

To reproduce this issue you need the lock file generated by the 4.9.5 core update and the 4.9.6 core update. Initially run a clean install of WordPress 4.9.5, after this completes update the WordPress core package (johnpbloch/wordpress-core) to point to 4.9.6 and then replace the current composer.lock with the lock file created by 4.9.6. The reason for this is that I update my lock file locally and push this to my staging and prod environments so a composer update command is never run anywhere except on my own dev machine. Run a composer install again and you will see that any packages installed by composer will be missing.

My composer.json is as follows:

  "name": "noneyabeeswax",
  "description": "...",
  "type": "project",
  "license": "GPL-2.0+",
  "authors": [
    {
      "name": "Linus Torvalds",
      "role": "Web Developer"
    },
    {
      "name": "Richard Stallman",
      "role": "Lead Developer"
    }
  ],
  "repositories":[
    {
      "type":"composer",
      "url":"https://wpackagist.org"
    }
  ],
  "minimum-stability": "dev",
  "prefer-stable": true,
  "config": {
    "sort-packages": true
  },
  "require": {
    "composer/installers": "^1.2",
    "drupal-composer/preserve-paths": "0.1.*",
    "johnpbloch/wordpress-core-installer": "^1.0",
    "johnpbloch/wordpress-core": "4.9.5",
    "wpackagist-plugin/broken-link-checker": "1.11.5",
    "wpackagist-plugin/cloudflare": "3.3.2",
    "wpackagist-plugin/contact-form-7": "5.0.1",
    "wpackagist-plugin/disable-author-pages": "0.11",
    "wpackagist-plugin/google-analytics-for-wordpress": "7.0.6",
    "wpackagist-plugin/google-sitemap-generator": "4.0.9",
    "wpackagist-plugin/jquery-updater": "2.1.4",
    "wpackagist-plugin/redirection": "3.2.1",
    "wpackagist-plugin/user-role-editor": "4.42",
    "wpackagist-plugin/validated": "2.1.2",
    "wpackagist-plugin/wordpress-importer": "0.6.4",
    "wpackagist-plugin/wpautop-control": "1.6",
    "wpackagist-plugin/wp-mail-smtp": "1.2.5"
  },
  "extra": {
    "installer-paths": {
      "web/wp-content/plugins/{$name}/": ["type:wordpress-plugin"],
      "web/wp-content/themes/{$name}/": ["type:wordpress-theme"]
    },
    "preserve-paths": [
      "web/wp-config.php",
      "web/wp-content/uploads",
      "web/wp-content/themes/custom-theme",
      "web/wp-content/plugins/custom-plugin1",
      "web/wp-content/plugins/custom-plugin2",
    ],
    "wordpress-install-dir": "web"
  }
}

[ChexWarrior]

I actually found a better solution to this issue over at the wordpress installer repo: https://github.com/johnpbloch/wordpress/issues/8#issuecomment-105761442

Instead of installing my plugins and themes in the web folder I install them in a directory outside of wordpress core and then in a post-install-cmd I copy the contents to the expected place within the web directory.

[csandanov]

I would recommend to look up how drupal guys do that, there's no such problem with contrib modules deletion while updating core. But for custom modules I personally use preserve-paths.