RubyGems - dependabot-composer - Versions diffs - 0.111.50 → 0.111.51 - Mend

dependabot-composer 0.111.50 → 0.111.51

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (903) hide show

data/helpers/vendor/composer/composer/doc/06-config.md DELETED

@@ -1,277 +0,0 @@
-# Config
-This chapter will describe the `config` section of the `composer.json`
-[schema](04-schema.md).
-## process-timeout
-Defaults to `300`. The duration processes like git clones can run before
-Composer assumes they died out. You may need to make this higher if you have a
-slow connection or huge vendors.
-## use-include-path
-Defaults to `false`. If `true`, the Composer autoloader will also look for classes
-in the PHP include path.
-## preferred-install
-Defaults to `auto` and can be any of `source`, `dist` or `auto`. This option
-allows you to set the install method Composer will prefer to use. Can
-optionally be a hash of patterns for more granular install preferences.
-```json
-{
-    "config": {
-        "preferred-install": {
-            "my-organization/stable-package": "dist",
-            "my-organization/*": "source",
-            "partner-organization/*": "auto",
-            "*": "dist"
-        }
-    }
-}
-```
-> **Note:** Order matters. More specific patterns should be earlier than
-> more relaxed patterns. When mixing the string notation with the hash
-> configuration in global and package configurations the string notation
-> is translated to a `*` package pattern.
-## store-auths
-What to do after prompting for authentication, one of: `true` (always store),
-`false` (do not store) and `"prompt"` (ask every time), defaults to `"prompt"`.
-## github-protocols
-Defaults to `["https", "ssh", "git"]`. A list of protocols to use when cloning
-from github.com, in priority order. By default `git` is present but only if [secure-http](#secure-http)
-is disabled, as the git protocol is not encrypted. If you want your origin remote
-push URLs to be using https and not ssh (`git@github.com:...`), then set the protocol
-list to be only `["https"]` and Composer will stop overwriting the push URL to an ssh
-URL.
-## github-oauth
-A list of domain names and oauth keys. For example using `{"github.com":
-"oauthtoken"}` as the value of this option will use `oauthtoken` to access
-private repositories on github and to circumvent the low IP-based rate limiting
-of their API. [Read
-more](articles/troubleshooting.md#api-rate-limit-and-oauth-tokens) on how to get
-an OAuth token for GitHub.
-## gitlab-oauth
-A list of domain names and oauth keys. For example using `{"gitlab.com":
-"oauthtoken"}` as the value of this option will use `oauthtoken` to access
-private repositories on gitlab. Please note: If the package is not hosted at
-gitlab.com the domain names must be also specified with the
-[`gitlab-domains`](06-config.md#gitlab-domains) option.
-## gitlab-token
-A list of domain names and private tokens. For example using `{"gitlab.com":
-"privatetoken"}` as the value of this option will use `privatetoken` to access
-private repositories on gitlab. Please note: If the package is not hosted at
-gitlab.com the domain names must be also specified with the
-[`gitlab-domains`](06-config.md#gitlab-domains) option.
-## disable-tls
-Defaults to `false`. If set to true all HTTPS URLs will be tried with HTTP
-instead and no network level encryption is performed. Enabling this is a
-security risk and is NOT recommended. The better way is to enable the
-php_openssl extension in php.ini.
-## secure-http
-Defaults to `true`. If set to true only HTTPS URLs are allowed to be
-downloaded via Composer. If you really absolutely need HTTP access to something
-then you can disable it, but using [Let's Encrypt](https://letsencrypt.org/) to
-get a free SSL certificate is generally a better alternative.
-## bitbucket-oauth
-A list of domain names and consumers. For example using `{"bitbucket.org":
-{"consumer-key": "myKey", "consumer-secret": "mySecret"}}`. [Read](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
-how to set up a consumer on Bitbucket.
-## cafile
-Location of Certificate Authority file on local filesystem. In PHP 5.6+ you
-should rather set this via openssl.cafile in php.ini, although PHP 5.6+ should
-be able to detect your system CA file automatically.
-## capath
-If cafile is not specified or if the certificate is not found there, the
-directory pointed to by capath is searched for a suitable certificate.
-capath must be a correctly hashed certificate directory.
-## http-basic
-A list of domain names and username/passwords to authenticate against them. For
-example using `{"example.org": {"username": "alice", "password": "foo"}}` as the
-value of this option will let Composer authenticate against example.org.
-> **Note:** Authentication-related config options like `http-basic` and
-> `github-oauth` can also be specified inside a `auth.json` file that goes
-> besides your `composer.json`. That way you can gitignore it and every
-> developer can place their own credentials in there.
-## platform
-Lets you fake platform packages (PHP and extensions) so that you can emulate a
-production env or define your target platform in the config. Example: `{"php":
-"7.0.3", "ext-something": "4.0.3"}`.
-## vendor-dir
-Defaults to `vendor`. You can install dependencies into a different directory if
-you want to. `$HOME` and `~` will be replaced by your home directory's path in
-vendor-dir and all `*-dir` options below.
-## bin-dir
-Defaults to `vendor/bin`. If a project includes binaries, they will be symlinked
-into this directory.
-## data-dir
-Defaults to `C:\Users\<user>\AppData\Roaming\Composer` on Windows,
-`$XDG_DATA_HOME/composer` on unix systems that follow the XDG Base Directory
-Specifications, and `$home` on other unix systems. Right now it is only
-used for storing past composer.phar files to be able to rollback to older
-versions. See also [COMPOSER_HOME](03-cli.md#composer-home).
-## cache-dir
-Defaults to `C:\Users\<user>\AppData\Local\Composer` on Windows,
-`$XDG_CACHE_HOME/composer` on unix systems that follow the XDG Base Directory
-Specifications, and `$home/cache` on other unix systems. Stores all the caches
-used by Composer. See also [COMPOSER_HOME](03-cli.md#composer-home).
-## cache-files-dir
-Defaults to `$cache-dir/files`. Stores the zip archives of packages.
-## cache-repo-dir
-Defaults to `$cache-dir/repo`. Stores repository metadata for the `composer`
-type and the VCS repos of type `svn`, `fossil`, `github` and `bitbucket`.
-## cache-vcs-dir
-Defaults to `$cache-dir/vcs`. Stores VCS clones for loading VCS repository
-metadata for the `git`/`hg` types and to speed up installs.
-## cache-files-ttl
-Defaults to `15552000` (6 months). Composer caches all dist (zip, tar, ..)
-packages that it downloads. Those are purged after six months of being unused by
-default. This option allows you to tweak this duration (in seconds) or disable
-it completely by setting it to 0.
-## cache-files-maxsize
-Defaults to `300MiB`. Composer caches all dist (zip, tar, ..) packages that it
-downloads. When the garbage collection is periodically ran, this is the maximum
-size the cache will be able to use. Older (less used) files will be removed
-first until the cache fits.
-## bin-compat
-Defaults to `auto`. Determines the compatibility of the binaries to be installed.
-If it is `auto` then Composer only installs .bat proxy files when on Windows. If
-set to `full` then both .bat files for Windows and scripts for Unix-based
-operating systems will be installed for each binary. This is mainly useful if you
-run Composer inside a linux VM but still want the .bat proxies available for use
-in the Windows host OS.
-## prepend-autoloader
-Defaults to `true`. If `false`, the Composer autoloader will not be prepended to
-existing autoloaders. This is sometimes required to fix interoperability issues
-with other autoloaders.
-## autoloader-suffix
-Defaults to `null`. String to be used as a suffix for the generated Composer
-autoloader. When null a random one will be generated.
-## optimize-autoloader
-Defaults to `false`. If `true`, always optimize when dumping the autoloader.
-## sort-packages
-Defaults to `false`. If `true`, the `require` command keeps packages sorted
-by name in `composer.json` when adding a new package.
-## classmap-authoritative
-Defaults to `false`. If `true`, the Composer autoloader will only load classes
-from the classmap. Implies `optimize-autoloader`.
-## apcu-autoloader
-Defaults to `false`. If `true`, the Composer autoloader will check for APCu and
-use it to cache found/not-found classes when the extension is enabled.
-## github-domains
-Defaults to `["github.com"]`. A list of domains to use in github mode. This is
-used for GitHub Enterprise setups.
-## github-expose-hostname
-Defaults to `true`. If `false`, the OAuth tokens created to access the
-github API will have a date instead of the machine hostname.
-## gitlab-domains
-Defaults to `["gitlab.com"]`. A list of domains of GitLab servers.
-This is used if you use the `gitlab` repository type.
-## notify-on-install
-Defaults to `true`. Composer allows repositories to define a notification URL,
-so that they get notified whenever a package from that repository is installed.
-This option allows you to disable that behaviour.
-## discard-changes
-Defaults to `false` and can be any of `true`, `false` or `"stash"`. This option
-allows you to set the default style of handling dirty updates when in
-non-interactive mode. `true` will always discard changes in vendors, while
-`"stash"` will try to stash and reapply. Use this for CI servers or deploy
-scripts if you tend to have modified vendors.
-## archive-format
-Defaults to `tar`. Composer allows you to add a default archive format when the
-workflow needs to create a dedicated archiving format.
-## archive-dir
-Defaults to `.`. Composer allows you to add a default archive directory when the
-workflow needs to create a dedicated archiving format. Or for easier development
-between modules.
-Example:
-```json
-{
-    "config": {
-        "archive-dir": "/home/user/.composer/repo"
-    }
-}
-```
-## htaccess-protect
-Defaults to `true`. If set to `false`, Composer will not create `.htaccess` files
-in the composer home, cache, and data directories.
-&larr; [Repositories](05-repositories.md)  |  [Community](07-community.md) &rarr;

data/helpers/vendor/composer/composer/doc/07-community.md DELETED

@@ -1,35 +0,0 @@
-# Community
-There are many people using Composer already, and quite a few of them are
-contributing.
-## Contributing
-If you would like to contribute to Composer, please read the
-[README](https://github.com/composer/composer) and
-[CONTRIBUTING](https://github.com/composer/composer/blob/master/.github/CONTRIBUTING.md)
-documents.
-The most important guidelines are described as follows:
-> All code contributions - including those of people having commit access - must
-> go through a pull request and approved by a core developer before being
-> merged. This is to ensure proper review of all the code.
->
-> Fork the project, create a feature branch, and send us a pull request.
->
-> To ensure a consistent code base, you should make sure the code follows
-> the [PSR-2 Coding Standards](http://www.php-fig.org/psr/psr-2/).
-## IRC / mailing list
-Mailing lists for [user support](https://groups.google.com/group/composer-users) and
-[development](https://groups.google.com/group/composer-dev).
-IRC channels are on irc.freenode.org: [#composer](irc://irc.freenode.org/composer)
-for users and [#composer-dev](irc://irc.freenode.org/composer-dev) for development.
-Stack Overflow has a growing collection of
-[Composer related questions](https://stackoverflow.com/questions/tagged/composer-php).
-&larr; [Config](06-config.md)

data/helpers/vendor/composer/composer/doc/articles/aliases.md DELETED

@@ -1,105 +0,0 @@
-<!--
-    tagline: Alias branch names to versions
--->
-# Aliases
-## Why aliases?
-When you are using a VCS repository, you will only get comparable versions for
-branches that look like versions, such as `2.0` or `2.0.x`. For your `master` branch, you
-will get a `dev-master` version. For your `bugfix` branch, you will get a
-`dev-bugfix` version.
-If your `master` branch is used to tag releases of the `1.0` development line,
-i.e. `1.0.1`, `1.0.2`, `1.0.3`, etc., any package depending on it will
-probably require version `1.0.*`.
-If anyone wants to require the latest `dev-master`, they have a problem: Other
-packages may require `1.0.*`, so requiring that dev version will lead to
-conflicts, since `dev-master` does not match the `1.0.*` constraint.
-Enter aliases.
-## Branch alias
-The `dev-master` branch is one in your main VCS repo. It is rather common that
-someone will want the latest master dev version. Thus, Composer allows you to
-alias your `dev-master` branch to a `1.0.x-dev` version. It is done by
-specifying a `branch-alias` field under `extra` in `composer.json`:
-```json
-{
-    "extra": {
-        "branch-alias": {
-            "dev-master": "1.0.x-dev"
-        }
-    }
-}
-```
-If you alias a non-comparable version (such as dev-develop) `dev-` must prefix the
-branch name. You may also alias a comparable version (i.e. start with numbers,
-and end with `.x-dev`), but only as a more specific version.
-For example, 1.x-dev could be aliased as 1.2.x-dev.
-The alias must be a comparable dev version, and the `branch-alias` must be present on
-the branch that it references. For `dev-master`, you need to commit it on the
-`master` branch.
-As a result, anyone can now require `1.0.*` and it will happily install
-`dev-master`.
-In order to use branch aliasing, you must own the repository of the package
-being aliased. If you want to alias a third party package without maintaining
-a fork of it, use inline aliases as described below.
-## Require inline alias
-Branch aliases are great for aliasing main development lines. But in order to
-use them you need to have control over the source repository, and you need to
-commit changes to version control.
-This is not really fun when you want to try a bugfix of some library that
-is a dependency of your local project.
-For this reason, you can alias packages in your `require` and `require-dev`
-fields. Let's say you found a bug in the `monolog/monolog` package. You cloned
-[Monolog](https://github.com/Seldaek/monolog) on GitHub and fixed the issue in
-a branch named `bugfix`. Now you want to install that version of monolog in your
-local project.
-You are using `symfony/monolog-bundle` which requires `monolog/monolog` version
-`1.*`. So you need your `dev-bugfix` to match that constraint.
-Add this to your project's root `composer.json`:
-```json
-{
-    "repositories": [
-        {
-            "type": "vcs",
-            "url": "https://github.com/you/monolog"
-        }
-    ],
-    "require": {
-        "symfony/monolog-bundle": "2.0",
-        "monolog/monolog": "dev-bugfix as 1.0.x-dev"
-    }
-}
-```
-That will fetch the `dev-bugfix` version of `monolog/monolog` from your GitHub
-and alias it to `1.0.x-dev`.
-> **Note:** Inline aliasing is a root-only feature. If a package with inline
-> aliases is required, the alias (right of the `as`) is used as the version
-> constraint. The part left of the `as` is discarded. As a consequence, if
-> A requires B and B requires `monolog/monolog` version `dev-bugfix as 1.0.x-dev`,
-> installing A will make B require `1.0.x-dev`, which may exist as a branch
-> alias or an actual `1.0` branch. If it does not, it must be
-> inline-aliased again in A's `composer.json`.
-> **Note:** Inline aliasing should be avoided, especially for published
-> packages/libraries. If you found a bug, try and get your fix merged upstream.
-> This helps to avoid issues for users of your package.

data/helpers/vendor/composer/composer/doc/articles/autoloader-optimization.md DELETED

@@ -1,111 +0,0 @@
-<!--
-    tagline: How to reduce the performance impact of the autoloader
--->
-# Autoloader Optimization
-By default, the Composer autoloader runs relatively fast. However, due to the way
-PSR-4 and PSR-0 autoloading rules are set up, it needs to check the filesystem
-before resolving a classname conclusively. This slows things down quite a bit,
-but it is convenient in development environments because when you add a new class
-it can immediately be discovered/used without having to rebuild the autoloader
-configuration.
-The problem however is in production you generally want things to happen as fast
-as possible, as you can simply rebuild the configuration every time you deploy and
-new classes do not appear at random between deploys.
-For this reason, Composer offers a few strategies to optimize the autoloader.
-> **Note:** You **should not** enable any of these optimizations in **development** as
-> they all will cause various problems when adding/removing classes. The performance
-> gains are not worth the trouble in a development setting.
-## Optimization Level 1: Class map generation
-### How to run it?
-There are a few options to enable this:
-- Set `"optimize-autoloader": true` inside the config key of composer.json
-- Call `install` or `update` with `-o` / `--optimize-autoloader`
-- Call `dump-autoload` with `-o` / `--optimize`
-### What does it do?
-Class map generation essentially converts PSR-4/PSR-0 rules into classmap rules.
-This makes everything quite a bit faster as for known classes the class map
-returns instantly the path, and Composer can guarantee the class is in there so
-there is no filesystem check needed.
-On PHP 5.6+, the class map is also cached in opcache which improves the initialization
-time greatly. If you make sure opcache is enabled, then the class map should load
-almost instantly and then class loading is fast.
-### Trade-offs
-There are no real trade-offs with this method. It should always be enabled in
-production.
-The only issue is it does not keep track of autoload misses (i.e. when
-it can not find a given class), so those fallback to PSR-4 rules and can still
-result in slow filesystem checks. To solve this issue two Level 2 optimization
-options exist, and you can decide to enable either if you have a lot of
-class_exists checks that are done for classes that do not exist in your project.
-## Optimization Level 2/A: Authoritative class maps
-### How to run it?
-There are a few options to enable this:
-- Set `"classmap-authoritative": true` inside the config key of composer.json
-- Call `install` or `update` with `-a` / `--classmap-authoritative`
-- Call `dump-autoload` with `-a` / `--classmap-authoritative`
-### What does it do?
-Enabling this automatically enables Level 1 class map optimizations.
-This option is very simple, it says that if something is not found in the classmap,
-then it does not exist and the autoloader should not attempt to look on the
-filesystem according to PSR-4 rules.
-### Trade-offs
-This option makes the autoloader always return very quickly. On the flipside it
-also means that in case a class is generated at runtime for some reason, it will
-not be allowed to be autoloaded. If your project or any of your dependencies does that
-then you might experience "class not found" issues in production. Enable this with care.
-> Note: This can not be combined with Level 2/B optimizations. You have to choose one as
-> they address the same issue in different ways.
-## Optimization Level 2/B: APCu cache
-### How to run it?
-There are a few options to enable this:
-- Set `"apcu-autoloader": true` inside the config key of composer.json
-- Call `install` or `update` with `--apcu-autoloader`
-- Call `dump-autoload` with `--apcu`
-### What does it do?
-This option adds an APCu cache as a fallback for the class map. It will not
-automatically generate the class map though, so you should still enable Level 1
-optimizations manually if you so desire.
-Whether a class is found or not, that fact is always cached in APCu so it can be
-returned quickly on the next request.
-### Trade-offs
-This option requires APCu which may or may not be available to you. It also
-uses APCu memory for autoloading purposes, but it is safe to use and can not
-result in classes not being found like the authoritative class map
-optimization above.
-> Note: This can not be combined with Level 2/A optimizations. You have to choose one as
-> they address the same issue in different ways.