RubyGems - dependabot-composer - Versions diffs - 0.108.8 → 0.108.9 - Mend

dependabot-composer 0.108.8 → 0.108.9

Files changed (901) hide show

data/helpers/vendor/composer/composer/doc/06-config.md DELETED

@@ -1,277 +0,0 @@
-# Config
-This chapter will describe the `config` section of the `composer.json`
-[schema](04-schema.md).
-## process-timeout
-Defaults to `300`. The duration processes like git clones can run before
-Composer assumes they died out. You may need to make this higher if you have a
-slow connection or huge vendors.
-## use-include-path
-Defaults to `false`. If `true`, the Composer autoloader will also look for classes
-in the PHP include path.
-## preferred-install
-Defaults to `auto` and can be any of `source`, `dist` or `auto`. This option
-allows you to set the install method Composer will prefer to use. Can
-optionally be a hash of patterns for more granular install preferences.
-```json
-{
-    "config": {
-        "preferred-install": {
-            "my-organization/stable-package": "dist",
-            "my-organization/*": "source",
-            "partner-organization/*": "auto",
-            "*": "dist"
-        }
-    }
-}
-```
-> **Note:** Order matters. More specific patterns should be earlier than
-> more relaxed patterns. When mixing the string notation with the hash
-> configuration in global and package configurations the string notation
-> is translated to a `*` package pattern.
-## store-auths
-What to do after prompting for authentication, one of: `true` (always store),
-`false` (do not store) and `"prompt"` (ask every time), defaults to `"prompt"`.
-## github-protocols
-Defaults to `["https", "ssh", "git"]`. A list of protocols to use when cloning
-from github.com, in priority order. By default `git` is present but only if [secure-http](#secure-http)
-is disabled, as the git protocol is not encrypted. If you want your origin remote
-push URLs to be using https and not ssh (`git@github.com:...`), then set the protocol
-list to be only `["https"]` and Composer will stop overwriting the push URL to an ssh
-URL.
-## github-oauth
-A list of domain names and oauth keys. For example using `{"github.com":
-"oauthtoken"}` as the value of this option will use `oauthtoken` to access
-private repositories on github and to circumvent the low IP-based rate limiting
-of their API. [Read
-more](articles/troubleshooting.md#api-rate-limit-and-oauth-tokens) on how to get
-an OAuth token for GitHub.
-## gitlab-oauth
-A list of domain names and oauth keys. For example using `{"gitlab.com":
-"oauthtoken"}` as the value of this option will use `oauthtoken` to access
-private repositories on gitlab. Please note: If the package is not hosted at
-gitlab.com the domain names must be also specified with the
-[`gitlab-domains`](06-config.md#gitlab-domains) option.
-## gitlab-token
-A list of domain names and private tokens. For example using `{"gitlab.com":
-"privatetoken"}` as the value of this option will use `privatetoken` to access
-private repositories on gitlab. Please note: If the package is not hosted at
-gitlab.com the domain names must be also specified with the
-[`gitlab-domains`](06-config.md#gitlab-domains) option.
-## disable-tls
-Defaults to `false`. If set to true all HTTPS URLs will be tried with HTTP
-instead and no network level encryption is performed. Enabling this is a
-security risk and is NOT recommended. The better way is to enable the
-php_openssl extension in php.ini.
-## secure-http
-Defaults to `true`. If set to true only HTTPS URLs are allowed to be
-downloaded via Composer. If you really absolutely need HTTP access to something
-then you can disable it, but using [Let's Encrypt](https://letsencrypt.org/) to
-get a free SSL certificate is generally a better alternative.
-## bitbucket-oauth
-A list of domain names and consumers. For example using `{"bitbucket.org":
-{"consumer-key": "myKey", "consumer-secret": "mySecret"}}`. [Read](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
-how to set up a consumer on Bitbucket.
-## cafile
-Location of Certificate Authority file on local filesystem. In PHP 5.6+ you
-should rather set this via openssl.cafile in php.ini, although PHP 5.6+ should
-be able to detect your system CA file automatically.
-## capath
-If cafile is not specified or if the certificate is not found there, the
-directory pointed to by capath is searched for a suitable certificate.
-capath must be a correctly hashed certificate directory.
-## http-basic
-A list of domain names and username/passwords to authenticate against them. For
-example using `{"example.org": {"username": "alice", "password": "foo"}}` as the
-value of this option will let Composer authenticate against example.org.
-> **Note:** Authentication-related config options like `http-basic` and
-> `github-oauth` can also be specified inside a `auth.json` file that goes
-> besides your `composer.json`. That way you can gitignore it and every
-> developer can place their own credentials in there.
-## platform
-Lets you fake platform packages (PHP and extensions) so that you can emulate a
-production env or define your target platform in the config. Example: `{"php":
-"7.0.3", "ext-something": "4.0.3"}`.
-## vendor-dir
-Defaults to `vendor`. You can install dependencies into a different directory if
-you want to. `$HOME` and `~` will be replaced by your home directory's path in
-vendor-dir and all `*-dir` options below.
-## bin-dir
-Defaults to `vendor/bin`. If a project includes binaries, they will be symlinked
-into this directory.
-## data-dir
-Defaults to `C:\Users\<user>\AppData\Roaming\Composer` on Windows,
-`$XDG_DATA_HOME/composer` on unix systems that follow the XDG Base Directory
-Specifications, and `$home` on other unix systems. Right now it is only
-used for storing past composer.phar files to be able to rollback to older
-versions. See also [COMPOSER_HOME](03-cli.md#composer-home).
-## cache-dir
-Defaults to `C:\Users\<user>\AppData\Local\Composer` on Windows,
-`$XDG_CACHE_HOME/composer` on unix systems that follow the XDG Base Directory
-Specifications, and `$home/cache` on other unix systems. Stores all the caches
-used by Composer. See also [COMPOSER_HOME](03-cli.md#composer-home).
-## cache-files-dir
-Defaults to `$cache-dir/files`. Stores the zip archives of packages.
-## cache-repo-dir
-Defaults to `$cache-dir/repo`. Stores repository metadata for the `composer`
-type and the VCS repos of type `svn`, `fossil`, `github` and `bitbucket`.
-## cache-vcs-dir
-Defaults to `$cache-dir/vcs`. Stores VCS clones for loading VCS repository
-metadata for the `git`/`hg` types and to speed up installs.
-## cache-files-ttl
-Defaults to `15552000` (6 months). Composer caches all dist (zip, tar, ..)
-packages that it downloads. Those are purged after six months of being unused by
-default. This option allows you to tweak this duration (in seconds) or disable
-it completely by setting it to 0.
-## cache-files-maxsize
-Defaults to `300MiB`. Composer caches all dist (zip, tar, ..) packages that it
-downloads. When the garbage collection is periodically ran, this is the maximum
-size the cache will be able to use. Older (less used) files will be removed
-first until the cache fits.
-## bin-compat
-Defaults to `auto`. Determines the compatibility of the binaries to be installed.
-If it is `auto` then Composer only installs .bat proxy files when on Windows. If
-set to `full` then both .bat files for Windows and scripts for Unix-based
-operating systems will be installed for each binary. This is mainly useful if you
-run Composer inside a linux VM but still want the .bat proxies available for use
-in the Windows host OS.
-## prepend-autoloader
-Defaults to `true`. If `false`, the Composer autoloader will not be prepended to
-existing autoloaders. This is sometimes required to fix interoperability issues
-with other autoloaders.
-## autoloader-suffix
-Defaults to `null`. String to be used as a suffix for the generated Composer
-autoloader. When null a random one will be generated.
-## optimize-autoloader
-Defaults to `false`. If `true`, always optimize when dumping the autoloader.
-## sort-packages
-Defaults to `false`. If `true`, the `require` command keeps packages sorted
-by name in `composer.json` when adding a new package.
-## classmap-authoritative
-Defaults to `false`. If `true`, the Composer autoloader will only load classes
-from the classmap. Implies `optimize-autoloader`.
-## apcu-autoloader
-Defaults to `false`. If `true`, the Composer autoloader will check for APCu and
-use it to cache found/not-found classes when the extension is enabled.
-## github-domains
-Defaults to `["github.com"]`. A list of domains to use in github mode. This is
-used for GitHub Enterprise setups.
-## github-expose-hostname
-Defaults to `true`. If `false`, the OAuth tokens created to access the
-github API will have a date instead of the machine hostname.
-## gitlab-domains
-Defaults to `["gitlab.com"]`. A list of domains of GitLab servers.
-This is used if you use the `gitlab` repository type.
-## notify-on-install
-Defaults to `true`. Composer allows repositories to define a notification URL,
-so that they get notified whenever a package from that repository is installed.
-This option allows you to disable that behaviour.
-## discard-changes
-Defaults to `false` and can be any of `true`, `false` or `"stash"`. This option
-allows you to set the default style of handling dirty updates when in
-non-interactive mode. `true` will always discard changes in vendors, while
-`"stash"` will try to stash and reapply. Use this for CI servers or deploy
-scripts if you tend to have modified vendors.
-## archive-format
-Defaults to `tar`. Composer allows you to add a default archive format when the
-workflow needs to create a dedicated archiving format.
-## archive-dir
-Defaults to `.`. Composer allows you to add a default archive directory when the
-workflow needs to create a dedicated archiving format. Or for easier development
-between modules.
-Example:
-```json
-{
-    "config": {
-        "archive-dir": "/home/user/.composer/repo"
-    }
-}
-```
-## htaccess-protect
-Defaults to `true`. If set to `false`, Composer will not create `.htaccess` files
-in the composer home, cache, and data directories.
-&larr; [Repositories](05-repositories.md)  |  [Community](07-community.md) &rarr;

data/helpers/vendor/composer/composer/doc/07-community.md DELETED

@@ -1,35 +0,0 @@
-# Community
-There are many people using Composer already, and quite a few of them are
-contributing.
-## Contributing
-If you would like to contribute to Composer, please read the
-[README](https://github.com/composer/composer) and
-[CONTRIBUTING](https://github.com/composer/composer/blob/master/.github/CONTRIBUTING.md)
-documents.
-The most important guidelines are described as follows:
-> All code contributions - including those of people having commit access - must
-> go through a pull request and approved by a core developer before being
-> merged. This is to ensure proper review of all the code.
->
-> Fork the project, create a feature branch, and send us a pull request.
->
-> To ensure a consistent code base, you should make sure the code follows
-> the [PSR-2 Coding Standards](http://www.php-fig.org/psr/psr-2/).
-## IRC / mailing list
-Mailing lists for [user support](https://groups.google.com/group/composer-users) and
-[development](https://groups.google.com/group/composer-dev).
-IRC channels are on irc.freenode.org: [#composer](irc://irc.freenode.org/composer)
-for users and [#composer-dev](irc://irc.freenode.org/composer-dev) for development.
-Stack Overflow has a growing collection of
-[Composer related questions](https://stackoverflow.com/questions/tagged/composer-php).
-&larr; [Config](06-config.md)

data/helpers/vendor/composer/composer/doc/articles/aliases.md DELETED

@@ -1,105 +0,0 @@
-<!--
-    tagline: Alias branch names to versions
--->
-# Aliases
-## Why aliases?
-When you are using a VCS repository, you will only get comparable versions for
-branches that look like versions, such as `2.0` or `2.0.x`. For your `master` branch, you
-will get a `dev-master` version. For your `bugfix` branch, you will get a
-`dev-bugfix` version.
-If your `master` branch is used to tag releases of the `1.0` development line,
-i.e. `1.0.1`, `1.0.2`, `1.0.3`, etc., any package depending on it will
-probably require version `1.0.*`.
-If anyone wants to require the latest `dev-master`, they have a problem: Other
-packages may require `1.0.*`, so requiring that dev version will lead to
-conflicts, since `dev-master` does not match the `1.0.*` constraint.
-Enter aliases.
-## Branch alias
-The `dev-master` branch is one in your main VCS repo. It is rather common that
-someone will want the latest master dev version. Thus, Composer allows you to
-alias your `dev-master` branch to a `1.0.x-dev` version. It is done by
-specifying a `branch-alias` field under `extra` in `composer.json`:
-```json
-{
-    "extra": {
-        "branch-alias": {
-            "dev-master": "1.0.x-dev"
-        }
-    }
-}
-```
-If you alias a non-comparable version (such as dev-develop) `dev-` must prefix the
-branch name. You may also alias a comparable version (i.e. start with numbers,
-and end with `.x-dev`), but only as a more specific version.
-For example, 1.x-dev could be aliased as 1.2.x-dev.
-The alias must be a comparable dev version, and the `branch-alias` must be present on
-the branch that it references. For `dev-master`, you need to commit it on the
-`master` branch.
-As a result, anyone can now require `1.0.*` and it will happily install
-`dev-master`.
-In order to use branch aliasing, you must own the repository of the package
-being aliased. If you want to alias a third party package without maintaining
-a fork of it, use inline aliases as described below.
-## Require inline alias
-Branch aliases are great for aliasing main development lines. But in order to
-use them you need to have control over the source repository, and you need to
-commit changes to version control.
-This is not really fun when you want to try a bugfix of some library that
-is a dependency of your local project.
-For this reason, you can alias packages in your `require` and `require-dev`
-fields. Let's say you found a bug in the `monolog/monolog` package. You cloned
-[Monolog](https://github.com/Seldaek/monolog) on GitHub and fixed the issue in
-a branch named `bugfix`. Now you want to install that version of monolog in your
-local project.
-You are using `symfony/monolog-bundle` which requires `monolog/monolog` version
-`1.*`. So you need your `dev-bugfix` to match that constraint.
-Add this to your project's root `composer.json`:
-```json
-{
-    "repositories": [
-        {
-            "type": "vcs",
-            "url": "https://github.com/you/monolog"
-        }
-    ],
-    "require": {
-        "symfony/monolog-bundle": "2.0",
-        "monolog/monolog": "dev-bugfix as 1.0.x-dev"
-    }
-}
-```
-That will fetch the `dev-bugfix` version of `monolog/monolog` from your GitHub
-and alias it to `1.0.x-dev`.
-> **Note:** Inline aliasing is a root-only feature. If a package with inline
-> aliases is required, the alias (right of the `as`) is used as the version
-> constraint. The part left of the `as` is discarded. As a consequence, if
-> A requires B and B requires `monolog/monolog` version `dev-bugfix as 1.0.x-dev`,
-> installing A will make B require `1.0.x-dev`, which may exist as a branch
-> alias or an actual `1.0` branch. If it does not, it must be
-> inline-aliased again in A's `composer.json`.
-> **Note:** Inline aliasing should be avoided, especially for published
-> packages/libraries. If you found a bug, try and get your fix merged upstream.
-> This helps to avoid issues for users of your package.

data/helpers/vendor/composer/composer/doc/articles/autoloader-optimization.md DELETED

@@ -1,111 +0,0 @@
-<!--
-    tagline: How to reduce the performance impact of the autoloader
--->
-# Autoloader Optimization
-By default, the Composer autoloader runs relatively fast. However, due to the way
-PSR-4 and PSR-0 autoloading rules are set up, it needs to check the filesystem
-before resolving a classname conclusively. This slows things down quite a bit,
-but it is convenient in development environments because when you add a new class
-it can immediately be discovered/used without having to rebuild the autoloader
-configuration.
-The problem however is in production you generally want things to happen as fast
-as possible, as you can simply rebuild the configuration every time you deploy and
-new classes do not appear at random between deploys.
-For this reason, Composer offers a few strategies to optimize the autoloader.
-> **Note:** You **should not** enable any of these optimizations in **development** as
-> they all will cause various problems when adding/removing classes. The performance
-> gains are not worth the trouble in a development setting.
-## Optimization Level 1: Class map generation
-### How to run it?
-There are a few options to enable this:
-- Set `"optimize-autoloader": true` inside the config key of composer.json
-- Call `install` or `update` with `-o` / `--optimize-autoloader`
-- Call `dump-autoload` with `-o` / `--optimize`
-### What does it do?
-Class map generation essentially converts PSR-4/PSR-0 rules into classmap rules.
-This makes everything quite a bit faster as for known classes the class map
-returns instantly the path, and Composer can guarantee the class is in there so
-there is no filesystem check needed.
-On PHP 5.6+, the class map is also cached in opcache which improves the initialization
-time greatly. If you make sure opcache is enabled, then the class map should load
-almost instantly and then class loading is fast.
-### Trade-offs
-There are no real trade-offs with this method. It should always be enabled in
-production.
-The only issue is it does not keep track of autoload misses (i.e. when
-it can not find a given class), so those fallback to PSR-4 rules and can still
-result in slow filesystem checks. To solve this issue two Level 2 optimization
-options exist, and you can decide to enable either if you have a lot of
-class_exists checks that are done for classes that do not exist in your project.
-## Optimization Level 2/A: Authoritative class maps
-### How to run it?
-There are a few options to enable this:
-- Set `"classmap-authoritative": true` inside the config key of composer.json
-- Call `install` or `update` with `-a` / `--classmap-authoritative`
-- Call `dump-autoload` with `-a` / `--classmap-authoritative`
-### What does it do?
-Enabling this automatically enables Level 1 class map optimizations.
-This option is very simple, it says that if something is not found in the classmap,
-then it does not exist and the autoloader should not attempt to look on the
-filesystem according to PSR-4 rules.
-### Trade-offs
-This option makes the autoloader always return very quickly. On the flipside it
-also means that in case a class is generated at runtime for some reason, it will
-not be allowed to be autoloaded. If your project or any of your dependencies does that
-then you might experience "class not found" issues in production. Enable this with care.
-> Note: This can not be combined with Level 2/B optimizations. You have to choose one as
-> they address the same issue in different ways.
-## Optimization Level 2/B: APCu cache
-### How to run it?
-There are a few options to enable this:
-- Set `"apcu-autoloader": true` inside the config key of composer.json
-- Call `install` or `update` with `--apcu-autoloader`
-- Call `dump-autoload` with `--apcu`
-### What does it do?
-This option adds an APCu cache as a fallback for the class map. It will not
-automatically generate the class map though, so you should still enable Level 1
-optimizations manually if you so desire.
-Whether a class is found or not, that fact is always cached in APCu so it can be
-returned quickly on the next request.
-### Trade-offs
-This option requires APCu which may or may not be available to you. It also
-uses APCu memory for autoloading purposes, but it is safe to use and can not
-result in classes not being found like the authoritative class map
-optimization above.
-> Note: This can not be combined with Level 2/A optimizations. You have to choose one as
-> they address the same issue in different ways.