dependabot-composer 0.107.13 → 0.107.14

data/helpers/vendor/composer/composer/doc/06-config.md

@@ -0,0 +1,277 @@
+# Config
+
+This chapter will describe the `config` section of the `composer.json`
+[schema](04-schema.md).
+
+## process-timeout
+
+Defaults to `300`. The duration processes like git clones can run before
+Composer assumes they died out. You may need to make this higher if you have a
+slow connection or huge vendors.
+
+## use-include-path
+
+Defaults to `false`. If `true`, the Composer autoloader will also look for classes
+in the PHP include path.
+
+## preferred-install
+
+Defaults to `auto` and can be any of `source`, `dist` or `auto`. This option
+allows you to set the install method Composer will prefer to use. Can
+optionally be a hash of patterns for more granular install preferences.
+
+```json
+{
+    "config": {
+        "preferred-install": {
+            "my-organization/stable-package": "dist",
+            "my-organization/*": "source",
+            "partner-organization/*": "auto",
+            "*": "dist"
+        }
+    }
+}
+```
+
+> **Note:** Order matters. More specific patterns should be earlier than
+> more relaxed patterns. When mixing the string notation with the hash
+> configuration in global and package configurations the string notation
+> is translated to a `*` package pattern.
+
+## store-auths
+
+What to do after prompting for authentication, one of: `true` (always store),
+`false` (do not store) and `"prompt"` (ask every time), defaults to `"prompt"`.
+
+## github-protocols
+
+Defaults to `["https", "ssh", "git"]`. A list of protocols to use when cloning
+from github.com, in priority order. By default `git` is present but only if [secure-http](#secure-http)
+is disabled, as the git protocol is not encrypted. If you want your origin remote
+push URLs to be using https and not ssh (`git@github.com:...`), then set the protocol
+list to be only `["https"]` and Composer will stop overwriting the push URL to an ssh
+URL.
+
+## github-oauth
+
+A list of domain names and oauth keys. For example using `{"github.com":
+"oauthtoken"}` as the value of this option will use `oauthtoken` to access
+private repositories on github and to circumvent the low IP-based rate limiting
+of their API. [Read
+more](articles/troubleshooting.md#api-rate-limit-and-oauth-tokens) on how to get
+an OAuth token for GitHub.
+
+## gitlab-oauth
+
+A list of domain names and oauth keys. For example using `{"gitlab.com":
+"oauthtoken"}` as the value of this option will use `oauthtoken` to access
+private repositories on gitlab. Please note: If the package is not hosted at 
+gitlab.com the domain names must be also specified with the 
+[`gitlab-domains`](06-config.md#gitlab-domains) option.
+
+## gitlab-token
+
+A list of domain names and private tokens. For example using `{"gitlab.com":
+"privatetoken"}` as the value of this option will use `privatetoken` to access
+private repositories on gitlab. Please note: If the package is not hosted at 
+gitlab.com the domain names must be also specified with the 
+[`gitlab-domains`](06-config.md#gitlab-domains) option.
+
+## disable-tls
+
+Defaults to `false`. If set to true all HTTPS URLs will be tried with HTTP
+instead and no network level encryption is performed. Enabling this is a
+security risk and is NOT recommended. The better way is to enable the
+php_openssl extension in php.ini.
+
+## secure-http
+
+Defaults to `true`. If set to true only HTTPS URLs are allowed to be
+downloaded via Composer. If you really absolutely need HTTP access to something
+then you can disable it, but using [Let's Encrypt](https://letsencrypt.org/) to
+get a free SSL certificate is generally a better alternative.
+
+## bitbucket-oauth
+
+A list of domain names and consumers. For example using `{"bitbucket.org":
+{"consumer-key": "myKey", "consumer-secret": "mySecret"}}`. [Read](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
+how to set up a consumer on Bitbucket.
+
+## cafile
+
+Location of Certificate Authority file on local filesystem. In PHP 5.6+ you
+should rather set this via openssl.cafile in php.ini, although PHP 5.6+ should
+be able to detect your system CA file automatically.
+
+## capath
+
+If cafile is not specified or if the certificate is not found there, the
+directory pointed to by capath is searched for a suitable certificate.
+capath must be a correctly hashed certificate directory.
+
+## http-basic
+
+A list of domain names and username/passwords to authenticate against them. For
+example using `{"example.org": {"username": "alice", "password": "foo"}}` as the
+value of this option will let Composer authenticate against example.org.
+
+> **Note:** Authentication-related config options like `http-basic` and
+> `github-oauth` can also be specified inside a `auth.json` file that goes
+> besides your `composer.json`. That way you can gitignore it and every
+> developer can place their own credentials in there.
+
+## platform
+
+Lets you fake platform packages (PHP and extensions) so that you can emulate a
+production env or define your target platform in the config. Example: `{"php":
+"7.0.3", "ext-something": "4.0.3"}`.
+
+## vendor-dir
+
+Defaults to `vendor`. You can install dependencies into a different directory if
+you want to. `$HOME` and `~` will be replaced by your home directory's path in
+vendor-dir and all `*-dir` options below.
+
+## bin-dir
+
+Defaults to `vendor/bin`. If a project includes binaries, they will be symlinked
+into this directory.
+
+## data-dir
+
+Defaults to `C:\Users\<user>\AppData\Roaming\Composer` on Windows,
+`$XDG_DATA_HOME/composer` on unix systems that follow the XDG Base Directory
+Specifications, and `$home` on other unix systems. Right now it is only
+used for storing past composer.phar files to be able to rollback to older
+versions. See also [COMPOSER_HOME](03-cli.md#composer-home).
+
+## cache-dir
+
+Defaults to `C:\Users\<user>\AppData\Local\Composer` on Windows,
+`$XDG_CACHE_HOME/composer` on unix systems that follow the XDG Base Directory
+Specifications, and `$home/cache` on other unix systems. Stores all the caches
+used by Composer. See also [COMPOSER_HOME](03-cli.md#composer-home).
+
+## cache-files-dir
+
+Defaults to `$cache-dir/files`. Stores the zip archives of packages.
+
+## cache-repo-dir
+
+Defaults to `$cache-dir/repo`. Stores repository metadata for the `composer`
+type and the VCS repos of type `svn`, `fossil`, `github` and `bitbucket`.
+
+## cache-vcs-dir
+
+Defaults to `$cache-dir/vcs`. Stores VCS clones for loading VCS repository
+metadata for the `git`/`hg` types and to speed up installs.
+
+## cache-files-ttl
+
+Defaults to `15552000` (6 months). Composer caches all dist (zip, tar, ..)
+packages that it downloads. Those are purged after six months of being unused by
+default. This option allows you to tweak this duration (in seconds) or disable
+it completely by setting it to 0.
+
+## cache-files-maxsize
+
+Defaults to `300MiB`. Composer caches all dist (zip, tar, ..) packages that it
+downloads. When the garbage collection is periodically ran, this is the maximum
+size the cache will be able to use. Older (less used) files will be removed
+first until the cache fits.
+
+## bin-compat
+
+Defaults to `auto`. Determines the compatibility of the binaries to be installed.
+If it is `auto` then Composer only installs .bat proxy files when on Windows. If
+set to `full` then both .bat files for Windows and scripts for Unix-based
+operating systems will be installed for each binary. This is mainly useful if you
+run Composer inside a linux VM but still want the .bat proxies available for use
+in the Windows host OS.
+
+## prepend-autoloader
+
+Defaults to `true`. If `false`, the Composer autoloader will not be prepended to
+existing autoloaders. This is sometimes required to fix interoperability issues
+with other autoloaders.
+
+## autoloader-suffix
+
+Defaults to `null`. String to be used as a suffix for the generated Composer
+autoloader. When null a random one will be generated.
+
+## optimize-autoloader
+
+Defaults to `false`. If `true`, always optimize when dumping the autoloader.
+
+## sort-packages
+
+Defaults to `false`. If `true`, the `require` command keeps packages sorted
+by name in `composer.json` when adding a new package.
+
+## classmap-authoritative
+
+Defaults to `false`. If `true`, the Composer autoloader will only load classes
+from the classmap. Implies `optimize-autoloader`.
+
+## apcu-autoloader
+
+Defaults to `false`. If `true`, the Composer autoloader will check for APCu and
+use it to cache found/not-found classes when the extension is enabled.
+
+## github-domains
+
+Defaults to `["github.com"]`. A list of domains to use in github mode. This is
+used for GitHub Enterprise setups.
+
+## github-expose-hostname
+
+Defaults to `true`. If `false`, the OAuth tokens created to access the
+github API will have a date instead of the machine hostname.
+
+## gitlab-domains
+
+Defaults to `["gitlab.com"]`. A list of domains of GitLab servers.
+This is used if you use the `gitlab` repository type.
+
+## notify-on-install
+
+Defaults to `true`. Composer allows repositories to define a notification URL,
+so that they get notified whenever a package from that repository is installed.
+This option allows you to disable that behaviour.
+
+## discard-changes
+
+Defaults to `false` and can be any of `true`, `false` or `"stash"`. This option
+allows you to set the default style of handling dirty updates when in
+non-interactive mode. `true` will always discard changes in vendors, while
+`"stash"` will try to stash and reapply. Use this for CI servers or deploy
+scripts if you tend to have modified vendors.
+
+## archive-format
+
+Defaults to `tar`. Composer allows you to add a default archive format when the
+workflow needs to create a dedicated archiving format.
+
+## archive-dir
+
+Defaults to `.`. Composer allows you to add a default archive directory when the
+workflow needs to create a dedicated archiving format. Or for easier development
+between modules.
+
+Example:
+
+```json
+{
+    "config": {
+        "archive-dir": "/home/user/.composer/repo"
+    }
+}
+```
+
+## htaccess-protect
+
+Defaults to `true`. If set to `false`, Composer will not create `.htaccess` files
+in the composer home, cache, and data directories.
+
+&larr; [Repositories](05-repositories.md)  |  [Community](07-community.md) &rarr;

data/helpers/vendor/composer/composer/doc/07-community.md

@@ -0,0 +1,35 @@
+# Community
+
+There are many people using Composer already, and quite a few of them are
+contributing.
+
+## Contributing
+
+If you would like to contribute to Composer, please read the
+[README](https://github.com/composer/composer) and
+[CONTRIBUTING](https://github.com/composer/composer/blob/master/.github/CONTRIBUTING.md)
+documents.
+
+The most important guidelines are described as follows:
+
+> All code contributions - including those of people having commit access - must
+> go through a pull request and approved by a core developer before being
+> merged. This is to ensure proper review of all the code.
+>
+> Fork the project, create a feature branch, and send us a pull request.
+>
+> To ensure a consistent code base, you should make sure the code follows
+> the [PSR-2 Coding Standards](http://www.php-fig.org/psr/psr-2/).
+
+## IRC / mailing list
+
+Mailing lists for [user support](https://groups.google.com/group/composer-users) and
+[development](https://groups.google.com/group/composer-dev).
+
+IRC channels are on irc.freenode.org: [#composer](irc://irc.freenode.org/composer)
+for users and [#composer-dev](irc://irc.freenode.org/composer-dev) for development.
+
+Stack Overflow has a growing collection of
+[Composer related questions](https://stackoverflow.com/questions/tagged/composer-php).
+
+← [Config](06-config.md)

data/helpers/vendor/composer/composer/doc/articles/aliases.md

@@ -0,0 +1,105 @@
+<!--
+    tagline: Alias branch names to versions
+-->
+
+# Aliases
+
+## Why aliases?
+
+When you are using a VCS repository, you will only get comparable versions for
+branches that look like versions, such as `2.0` or `2.0.x`. For your `master` branch, you
+will get a `dev-master` version. For your `bugfix` branch, you will get a
+`dev-bugfix` version.
+
+If your `master` branch is used to tag releases of the `1.0` development line,
+i.e. `1.0.1`, `1.0.2`, `1.0.3`, etc., any package depending on it will
+probably require version `1.0.*`.
+
+If anyone wants to require the latest `dev-master`, they have a problem: Other
+packages may require `1.0.*`, so requiring that dev version will lead to
+conflicts, since `dev-master` does not match the `1.0.*` constraint.
+
+Enter aliases.
+
+## Branch alias
+
+The `dev-master` branch is one in your main VCS repo. It is rather common that
+someone will want the latest master dev version. Thus, Composer allows you to
+alias your `dev-master` branch to a `1.0.x-dev` version. It is done by
+specifying a `branch-alias` field under `extra` in `composer.json`:
+
+```json
+{
+    "extra": {
+        "branch-alias": {
+            "dev-master": "1.0.x-dev"
+        }
+    }
+}
+```
+
+If you alias a non-comparable version (such as dev-develop) `dev-` must prefix the
+branch name. You may also alias a comparable version (i.e. start with numbers,
+and end with `.x-dev`), but only as a more specific version.
+For example, 1.x-dev could be aliased as 1.2.x-dev.
+
+The alias must be a comparable dev version, and the `branch-alias` must be present on
+the branch that it references. For `dev-master`, you need to commit it on the
+`master` branch.
+
+As a result, anyone can now require `1.0.*` and it will happily install
+`dev-master`.
+
+In order to use branch aliasing, you must own the repository of the package
+being aliased. If you want to alias a third party package without maintaining
+a fork of it, use inline aliases as described below.
+
+## Require inline alias
+
+Branch aliases are great for aliasing main development lines. But in order to
+use them you need to have control over the source repository, and you need to
+commit changes to version control.
+
+This is not really fun when you want to try a bugfix of some library that
+is a dependency of your local project.
+
+For this reason, you can alias packages in your `require` and `require-dev`
+fields. Let's say you found a bug in the `monolog/monolog` package. You cloned
+[Monolog](https://github.com/Seldaek/monolog) on GitHub and fixed the issue in
+a branch named `bugfix`. Now you want to install that version of monolog in your
+local project.
+
+You are using `symfony/monolog-bundle` which requires `monolog/monolog` version
+`1.*`. So you need your `dev-bugfix` to match that constraint.
+
+Add this to your project's root `composer.json`:
+
+```json
+{
+    "repositories": [
+        {
+            "type": "vcs",
+            "url": "https://github.com/you/monolog"
+        }
+    ],
+    "require": {
+        "symfony/monolog-bundle": "2.0",
+        "monolog/monolog": "dev-bugfix as 1.0.x-dev"
+    }
+}
+```
+
+That will fetch the `dev-bugfix` version of `monolog/monolog` from your GitHub
+and alias it to `1.0.x-dev`.
+
+> **Note:** Inline aliasing is a root-only feature. If a package with inline
+> aliases is required, the alias (right of the `as`) is used as the version
+> constraint. The part left of the `as` is discarded. As a consequence, if
+> A requires B and B requires `monolog/monolog` version `dev-bugfix as 1.0.x-dev`,
+> installing A will make B require `1.0.x-dev`, which may exist as a branch
+> alias or an actual `1.0` branch. If it does not, it must be
+> inline-aliased again in A's `composer.json`.
+
+> **Note:** Inline aliasing should be avoided, especially for published
+> packages/libraries. If you found a bug, try and get your fix merged upstream.
+> This helps to avoid issues for users of your package.

data/helpers/vendor/composer/composer/doc/articles/autoloader-optimization.md

@@ -0,0 +1,111 @@
+<!--
+    tagline: How to reduce the performance impact of the autoloader
+-->
+
+# Autoloader Optimization
+
+By default, the Composer autoloader runs relatively fast. However, due to the way
+PSR-4 and PSR-0 autoloading rules are set up, it needs to check the filesystem
+before resolving a classname conclusively. This slows things down quite a bit,
+but it is convenient in development environments because when you add a new class
+it can immediately be discovered/used without having to rebuild the autoloader
+configuration.
+
+The problem however is in production you generally want things to happen as fast
+as possible, as you can simply rebuild the configuration every time you deploy and
+new classes do not appear at random between deploys.
+
+For this reason, Composer offers a few strategies to optimize the autoloader.
+
+> **Note:** You **should not** enable any of these optimizations in **development** as
+> they all will cause various problems when adding/removing classes. The performance
+> gains are not worth the trouble in a development setting.
+
+## Optimization Level 1: Class map generation
+
+### How to run it?
+
+There are a few options to enable this:
+
+- Set `"optimize-autoloader": true` inside the config key of composer.json
+- Call `install` or `update` with `-o` / `--optimize-autoloader`
+- Call `dump-autoload` with `-o` / `--optimize`
+
+### What does it do?
+
+Class map generation essentially converts PSR-4/PSR-0 rules into classmap rules.
+This makes everything quite a bit faster as for known classes the class map
+returns instantly the path, and Composer can guarantee the class is in there so
+there is no filesystem check needed.
+
+On PHP 5.6+, the class map is also cached in opcache which improves the initialization
+time greatly. If you make sure opcache is enabled, then the class map should load
+almost instantly and then class loading is fast.
+
+### Trade-offs
+
+There are no real trade-offs with this method. It should always be enabled in
+production.
+
+The only issue is it does not keep track of autoload misses (i.e. when
+it can not find a given class), so those fallback to PSR-4 rules and can still
+result in slow filesystem checks. To solve this issue two Level 2 optimization
+options exist, and you can decide to enable either if you have a lot of
+class_exists checks that are done for classes that do not exist in your project.
+
+## Optimization Level 2/A: Authoritative class maps
+
+### How to run it?
+
+There are a few options to enable this:
+
+- Set `"classmap-authoritative": true` inside the config key of composer.json
+- Call `install` or `update` with `-a` / `--classmap-authoritative`
+- Call `dump-autoload` with `-a` / `--classmap-authoritative`
+
+### What does it do?
+
+Enabling this automatically enables Level 1 class map optimizations.
+
+This option is very simple, it says that if something is not found in the classmap,
+then it does not exist and the autoloader should not attempt to look on the
+filesystem according to PSR-4 rules.
+
+### Trade-offs
+
+This option makes the autoloader always return very quickly. On the flipside it
+also means that in case a class is generated at runtime for some reason, it will
+not be allowed to be autoloaded. If your project or any of your dependencies does that
+then you might experience "class not found" issues in production. Enable this with care.
+
+> Note: This can not be combined with Level 2/B optimizations. You have to choose one as
+> they address the same issue in different ways.
+
+## Optimization Level 2/B: APCu cache
+
+### How to run it?
+
+There are a few options to enable this:
+
+- Set `"apcu-autoloader": true` inside the config key of composer.json
+- Call `install` or `update` with `--apcu-autoloader`
+- Call `dump-autoload` with `--apcu`
+
+### What does it do?
+
+This option adds an APCu cache as a fallback for the class map. It will not
+automatically generate the class map though, so you should still enable Level 1
+optimizations manually if you so desire.
+
+Whether a class is found or not, that fact is always cached in APCu so it can be
+returned quickly on the next request.
+
+### Trade-offs
+
+This option requires APCu which may or may not be available to you. It also
+uses APCu memory for autoloading purposes, but it is safe to use and can not
+result in classes not being found like the authoritative class map
+optimization above.
+
+> Note: This can not be combined with Level 2/A optimizations. You have to choose one as
+> they address the same issue in different ways.