Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set allow-plugins for Composer 2.2 #405

Merged
merged 1 commit into from Dec 13, 2021
Merged

Set allow-plugins for Composer 2.2 #405

merged 1 commit into from Dec 13, 2021

Conversation

villfa
Copy link

@villfa villfa commented Dec 13, 2021

What is the reason for this PR?

A new configuration allow-plugins has been introduced with Composer 2.2: https://github.com/composer/composer/releases/tag/2.2.0-RC1

Quote from Composer's documentation:

Defaults to null (allow all plugins implicitly) for backwards compatibility until July 2022. At that point the default will become {} and plugins will not load anymore unless allowed.

As of Composer 2.2.0, the allow-plugins option adds a layer of security allowing you to restrict which Composer plugins are able to execute code during a Composer run.

When a new plugin is first activated, which is not yet listed in the config option, Composer will print a warning. If you run Composer interactively it will prompt you to decide if you want to execute the plugin or not.
  • A new feature
  • Fixed an issue (resolve #ID)
  • UX improvement

Author's checklist

Summary of changes

I've set allow-plugins with the only composer plugin used (bamarni/composer-bin-plugin).

Review checklist

  • All checks have passed
  • Changes are approved by maintainer

This new configuration has been introduced with Composer 2.2: https://github.com/composer/composer/releases/tag/2.2.0-RC1
@pimjansen
Copy link

How will this run on composer 1?

@villfa
Copy link
Author

villfa commented Dec 13, 2021

It will be simply ignored.

@pimjansen pimjansen merged commit 9470ee2 into FakerPHP:main Dec 13, 2021
@villfa villfa deleted the patch-1 branch December 13, 2021 20:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants