lapsrj/wp-dependencies-manager

Library that helps WordPress plugin dependency management.

4.4.0 2026-07-15 04:43 UTC

Requires

• php: >=5.6

MIT

• Leandro
• Andy Fragen
• Matt Gibbs
• Raruto

Published on Packagist.org on 2026-07-15 04:45 UTC

README

• Tags: plugin, dependency, install
• Requires at least: 5.1
• Requires PHP: 5.6
• License: MIT

A lightweight WordPress library for managing plugin dependencies. Declare required and recommended plugins via JSON, auto-install and activate them, and provide admins with a Dependencies page under the Plugins menu. Supports WordPress.org, GitHub, GitLab, Bitbucket, Gitea, direct URLs, and bundled ZIP files.

Based on WP Dependency Installer.

Description

You can use composer to install this package within your WordPress plugin / theme.

1. Within your plugin or theme root folder, run the following command:

composer require lapsrj/wp-dependencies-manager

1. Then create a wp-dependencies.json file:

[
  {
    "name": "Classic Editor",
    "host": "wordpress",
    "slug": "classic-editor/classic-editor.php",
    "uri": "https://wordpress.org/plugins/classic-editor/",
    "required": true
  },
  {
    "name": "Query Monitor",
    "host": "wordpress",
    "slug": "query-monitor/query-monitor.php",
    "uri": "https://wordpress.org/plugins/query-monitor/",
    "optional": true
  }
]

1. Add the following lines to your plugin or theme's functions.php file:

require_once __DIR__ . '/vendor/autoload.php';
add_action( 'after_setup_theme', static function() {
  WP_Dependencies_Manager::instance( __DIR__ )->run();
});

For plugins, use the plugins_loaded hook instead of after_setup_theme.

Bundled Plugins (Local ZIP)

You can bundle plugin ZIP files directly within your theme or plugin to distribute premium or private plugins. Place the ZIP file in a directory (e.g. bundled-plugins/) and reference it using "host": "local":

{
  "name": "My Premium Plugin",
  "host": "local",
  "slug": "my-premium-plugin/my-premium-plugin.php",
  "uri": "bundled-plugins/my-premium-plugin.zip",
  "required": true
}

The uri is a relative path from your theme or plugin root to the ZIP file.

Using PHP instead of JSON

You can also register dependencies programmatically, which works the same way for bundled plugins:

require_once __DIR__ . '/vendor/autoload.php';
add_action( 'after_setup_theme', static function() {
  $manager = WP_Dependencies_Manager::instance( __DIR__ );
  $manager->register( [
    [
      'name'     => 'My Premium Plugin',
      'host'     => 'local',
      'slug'     => 'my-premium-plugin/my-premium-plugin.php',
      'uri'      => 'bundled-plugins/my-premium-plugin.zip',
      'required' => true,
    ],
    [
      'name'     => 'Classic Editor',
      'host'     => 'wordpress',
      'slug'     => 'classic-editor/classic-editor.php',
      'uri'      => 'https://wordpress.org/plugins/classic-editor/',
      'required' => true,
    ],
  ], __DIR__ );
  $manager->run();
});

When using register() directly, pass the caller directory as the second argument so that local paths resolve correctly.

REST API

Declared dependencies can be listed, installed, and activated over the WordPress REST API. Unlike core's wp/v2/plugins endpoint (which only installs from WordPress.org by slug), these routes work for every source this library supports — GitHub, Bitbucket, GitLab, Gitea, direct URLs, and bundled local ZIPs. The routes are scoped to declared dependencies only, so this is not a general-purpose "install any plugin" endpoint.

Namespace: wp-dependencies-manager/v1

Method	Route	Capability	Description
GET	/dependencies	install_plugins	List declared dependencies with installed / active / required status.
POST	/dependencies/install	install_plugins + update_plugins	Install the dependency (and activate it if it is required).
POST	/dependencies/activate	activate_plugins	Activate an already-installed dependency.

Both POST routes take a slug parameter (the plugin file, e.g. classic-editor/classic-editor.php) in the request body.

Authenticate with an Application Password (WordPress 5.6+):

# List declared dependencies and their status
curl https://example.com/wp-json/wp-dependencies-manager/v1/dependencies \
  --user "admin:xxxx xxxx xxxx xxxx xxxx xxxx"

# Install a dependency
curl -X POST https://example.com/wp-json/wp-dependencies-manager/v1/dependencies/install \
  --user "admin:xxxx xxxx xxxx xxxx xxxx xxxx" \
  -d "slug=classic-editor/classic-editor.php"

# Activate a dependency
curl -X POST https://example.com/wp-json/wp-dependencies-manager/v1/dependencies/activate \
  --user "admin:xxxx xxxx xxxx xxxx xxxx xxxx" \
  -d "slug=classic-editor/classic-editor.php"

The routes are registered only when at least one dependency is declared (they hook into rest_api_init from load_hooks()).

Contributors

• Leandro
• Andy Fragen (original author)
• Matt Gibbs (original author)
• Raruto (original author)