Disable source-fallback by default, mark it deprecated and remove env/flags to override#12885
Conversation
…/flags to override
API Surface ChangesIf any of the additions below are not intended as public API, mark them with Removed API SurfaceMethods
Properties
Modified API SurfaceProperties
|
| "source-fallback": { | ||
| "type": "boolean", | ||
| "description": "If true (default), Composer will fall back to a different installation source (e.g., from dist to source or vice versa) when a download fails. Set to false to disable this behavior." | ||
| "description": "DEPRECATED, will be removed in Composer 2.11. Defaults to false. If true, Composer will fall back to a different installation source (e.g., from dist to source or vice versa) when a download fails. Automatic source fallback has security implications, please open an issue at https://github.com/composer/composer/issues if you need this kept around." |
There was a problem hiding this comment.
Can you add "deprecated": true?
There was a problem hiding this comment.
Ah yeah good point thanks
|
Is the PR that should be mentioned in the blog post?
|
|
Haha thanks, like 5 people read that and nobody noticed. |
|
We often pull from a branch on a staging environment to run tests, how would we do that going forward? |
|
Like you used to do? If there is a specific issue you'll have to be more specific :) Maybe read up on #12889 first tho it has a few pointers already but I'm really not sure which solution is for you because your problem description is too vague |
|
Yup saw that discussion after, got it working by removing |
|
Alright, are you also on GitLab or what's the environment? Could you share the exact error message you got? I am thinking we may be able to detect the error combined with the presence of --prefer-dist and output a clearer hint in this case, but the more info I have to pinpoint it the more detailed output we can give (without risking to mislead people in a completely different scenario). |
|
Nope this is on Laravel Forge (https://forge.laravel.com). They used to have that as part of their composer command defaults. So I had copied that command around on all my sites lol. Easy to remove. A full error message, if it helps: Note this is a private repo |
This new config option was added in #12698 (which is not yet released), and while discussing security related things lately we have come to the conclusion that falling back from dist to source or vice versa can be problematic in some cases and we'd rather disable that.
So the source-fallback option is now disabled by default in 2.10, and set to be removed in 2.11 (always off).
While motivated by security concerns, it is a behavior change that may affect users tho so we want to keep the option in 2.10 as an easier way to transition/upgrade, and to give everyone a chance to voice concerns in case this is a behavior people really rely on.