I think there was a composer plugin or smth that makes sure typical dev dependencies never end up in the require section of the lockfile, right? Which one is it? #followerpower#php#composer
Background: A colleague added a composer dev dependency by mistake to the require section in an internal plugin and nobody noticed. When requiring that plugin the dev dependency ended up in the lockfile and vendor of the main app and again nobody noticed. And I'd like to catch that.
@herndlm mk1 eyeball ask one of your least favourite team members to audit composer.json once in a while. adding things to screw with the operation of composer is going to be more annoying for anyone not the guy who first had the idea.
Add comment