README

A global Composer plugin that requires confirmation before a full composer update. It prevents accidental full dependency updates across the team — a common entry point for supply-chain attacks.

composer update → guarded (prompt; aborts with exit code 1 in --no-interaction mode)
composer update vendor/package → allowed (targeted, reviewed update)
composer update --dry-run → allowed (writes nothing)
composer update --lock → allowed (lock hash only)
composer install, composer require …, composer remove … → untouched

The plugin is installed globally per development machine and therefore automatically protects all of that user's projects.

Installation (once per team member)

Via Packagist

composer global config allow-plugins.montag-webstudios/composer-update-guard true
composer global require montag-webstudios/composer-update-guard

Directly from the Git repository (without Packagist)

composer global config repositories.update-guard vcs https://github.com/montag-webstudios/composer-update-guard
composer global config allow-plugins.montag-webstudios/composer-update-guard true
composer global require montag-webstudios/composer-update-guard

The allow-plugins.montag-webstudios/composer-update-guard true line is required as of Composer 2.2 so the plugin is allowed to load. If omitted, Composer will prompt interactively on first run.

Verify it is active

composer global show montag-webstudios/composer-update-guard
cd any/project && composer update --dry-run   # runs through
cd any/project && composer update             # prompts

Uninstall

composer global remove montag-webstudios/composer-update-guard

Publishing (maintainers)

Push this repository to https://github.com/montag-webstudios/composer-update-guard.
Submit it on https://packagist.org (Submit → repository URL). Add the GitHub webhook so Packagist auto-updates on push.
Tag a release (e.g. git tag v1.0.0 && git push --tags) so a stable version is installable.

Notes

Acts only locally on the development machine. CI should use composer install (lock-based) instead of composer update anyway; an accidental composer update --no-interaction in a script is stopped by the guard with exit code 1.
If you fork this under a different vendor, adjust name, the autoload namespace, extra.class in composer.json, and the namespace in src/.

montag-webstudios / composer-update-guard

Maintainers

Package info

Statistics

Security