Problem/Motivation

Composer 2.2.1 was released 2021-12-22
https://getcomposer.org/changelog/2.2.1
https://github.com/composer/composer/releases/tag/2.2.1

  • Fixed plugin autoloading including files autoload rules from the root package (#10382)
  • Fixed issue parsing php files with unterminated comments found inside backticks (#10385)

https://getcomposer.org/doc/06-config.md#allow-plugins

After updating the composer in local or in an automated testing you will face the following issue

composer/installers contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "composer/installers" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
y - add package to allow-plugins in composer.json and let it run immediately
n - add package (as disallowed) to allow-plugins in composer.json to suppress further prompts
d - discard this, do not change composer.json and do not allow the plugin to run
? - print help

A question to trust will show up for each used composer plugin in Varbase

Do you trust "composer/installers" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
cweagans/composer-patches contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "cweagans/composer-patches" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
oomphinc/composer-installers-extender contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "oomphinc/composer-installers-extender" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
drupal/core-composer-scaffold contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "drupal/core-composer-scaffold" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
drupal/core-project-message contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "drupal/core-project-message" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
vardot/varbase-updater contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "vardot/varbase-updater" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
dealerdirect/phpcodesniffer-composer-installer (installed globally) contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
dealerdirect/phpcodesniffer-composer-installer (installed globally) contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "dealerdirect/phpcodesniffer-composer-installer" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y

Proposed resolution

Adding allow-plugins to Varbase and Varbase Project template
Not to block builds or updates.

  "config": {
    "bin-dir": "bin/",
    "secure-http": false,
    "optimize-autoloader": true,
    "preferred-install": {
      "drupal/core": "dist"
    },
    "allow-plugins": {
      "composer/installers": true,
      "cweagans/composer-patches": true,
      "oomphinc/composer-installers-extender": true,
      "drupal/core-composer-scaffold": true,
      "drupal/core-project-message": true,
      "vardot/varbase-updater": true
    }
  },

Remaining tasks

  • ✅ File an issue about this project
  • ✅ Addition/Change/Update/Fix to this project
  • ✅ Testing to ensure no regression
  • ✅ Automated unit/functional testing coverage

    Varbase 9.1.x CircleCI Build Passing

    Varbase 9.1.x


    Varbase 9.0.x CircleCI Build Passing

    Varbase 9.0.x


  • ✅ Developer Documentation support on feature change/addition
  • ➖ User Guide Documentation support on feature change/addition
  • ➖ Update Release Notes and Update Helper on new feature change/addition
  • ✅ Code review from 1 Varbase core team member
  • ✅ Full testing and approval
  • ✅ Credit contributors
  • ✅ Review with the product owner
  • ✅ Release varbase-9.0.4

Varbase update type:

  • ✅ No Update
  • ➖ Optional Update
  • ➖ Forced Update
  • ➖ Forced Update if Unchanged

User interface changes

  • N/A

API changes

  • N/A

Data model changes

  • N/A

Comments

RajabNatshah created an issue. See original summary.

  • RajabNatshah committed aca77b5 on 9.1.x
    Issue #3255863: Add composer allow-plugins to composer.json for Varbase...

  • RajabNatshah committed af77190 on 9.0.x
    Issue #3255863: Add composer allow-plugins to composer.json for Varbase...
Rajab Natshah’s picture

Assigned: Rajab Natshah » Mohammed J. Razem
Issue summary: View changes
Status: Active » Needs review
Issue tags: +varbase-9.0.4, +varbase-9.1.0-beta1
Rajab Natshah’s picture

Issue summary: View changes
Rajab Natshah’s picture

Issue summary: View changes
Rajab Natshah’s picture

Assigned: Mohammed J. Razem » Unassigned
Rajab Natshah’s picture

Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

Rajab Natshah’s picture

Title: Add composer allow-plugins to composer.json for Varbase and Varbase Project template » Add composer allow-plugins to composer.json for Varbase and Varbase Project template to work with Composer 2.2.1 and later versions
tresero’s picture

Where exactly would this go? I need to add this to several sites and I don't really understand your composer paths.

Thanks

Rajab Natshah’s picture

Thanks, Jon for following this issue.

This is the case if you had the composer updated to the latest version 2.2.1 and later versions.
1. composer self-update
2. When doing a composer update or composer install ... all project will be faced with a question to trust any other composer plugins
Example:

Do you trust "composer/installers" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y

By trusting in the console the final results will add

    "allow-plugins": {
      "composer/installers": true,
      "cweagans/composer-patches": true,
      "oomphinc/composer-installers-extender": true,
      "drupal/core-composer-scaffold": true,
      "drupal/core-project-message": true,
      "vardot/varbase-updater": true
    }

Mainly for all new projects using Varbase Project template
The Varbase team trusted the composer plugins by default which are listed in the allow-plugins
Add composer allow-plugins to composer.json for Varbase and Varbase Project template to work with Composer 2.2.1 and later versions #124
So now the root composer.json file look as you can see in this link
https://github.com/Vardot/varbase-project/blob/9.0.x/composer.json#L51

Rajab Natshah’s picture

  1. All new projects should use the new template file
  2. All old projects will update to the new template when they call the composer command after they update the composer to latest

Working on #3257620: Release Varbase 9.0.4

mmjvb’s picture

The allow-plugins belongs to the config key. For existing projects you can `composer config allow-plugins true` to allow plugins like before. When upgrading your projects recommend whitelisting plugins, like done for Varbase. Newly introduced plugins need explicitly be allowed. Expect Composer to ask for it.

Rajab Natshah’s picture

Issue summary: View changes
Issue tags: -varbase-9.1.0-beta1
tresero’s picture

Interesting I have 4 varbase sites, they all ask to trust, and it's never written.

I run sudo for www-data which doesn't have a password which your upgrade script asks for (that's another issue). That may be the problem.

Rajab Natshah’s picture

thomaswalther’s picture

# 14 worked for me. Thanks!
No warning after I entered:
composer config allow-plugins true

mmjvb’s picture

You might even consider doing that global. It allows your projects to opt in at the time they desire.

tresero’s picture

This still doesn't work. Not sure why. Composer is definitely a weird beast.

Here is my composer.json in web dir.

 ...
   "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "allow-plugins": {
            "dealerdirect/phpcodesniffer-composer-installer": true,
            "composer/installers": true,
            "cweagans/composer-patches": true,
            "oomphinc/composer-installers-extender": true,
            "drupal/core-composer-scaffold": true,
            "drupal/core-project-message": true,
            "vardot/varbase-updater": true
        }
    }

I still get

Updating Varbase...
dealerdirect/phpcodesniffer-composer-installer contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "dealerdirect/phpcodesniffer-composer-installer" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
composer/installers contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "composer/installers" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
cweagans/composer-patches contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "cweagans/composer-patches" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
oomphinc/composer-installers-extender contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "oomphinc/composer-installers-extender" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
drupal/core-composer-scaffold contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "drupal/core-composer-scaffold" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
drupal/core-project-message contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "drupal/core-project-message" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
vardot/varbase-updater contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "vardot/varbase-updater" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] y
Loading composer repositories with package information

This happens every time on every Varbase site I have.

Ideas?

Thanks

Rajab Natshah’s picture

Version: 9.1.x-dev » 9.0.x-dev