pixelperfectat / composer-dependency-audit-plugin

1.0.0 2026-09-02 11:32 UTC

Requires

• php: ^8.1
• composer-plugin-api: ^2.0

Requires (Dev)

• composer/composer: ^2.0
• phpunit/phpunit: ^9.6

Replaces

• magento/composer-dependency-version-audit-plugin: *

OSL-3.0

• security
• plugin
• composer
• magento
• dependency-confusion

Published on Packagist.org on 2026-09-02 11:34 UTC

README

A fork of magento/composer-dependency-version-audit-plugin that adds a configurable vendor allow list.

What it does

Magento's original plugin guards against dependency confusion: it compares, for every package being installed with a non-fixed constraint (^, ~, *, a range), the best version available in a private repository against the best version available on Packagist. If Packagist has a higher matching version than the private repository does, it throws, aborting the install — the working theory being that a public package of the same name may have been taken over by a malicious actor and republished with a higher version number to win dependency resolution.

That check is correct, but it carries a private, unconditional vendor list. A shop that develops its own modules as local path repositories, and also publishes the same package names publicly (for reuse across its own projects), fails the comparison permanently: the path repository always resolves to a development version tied to the current commit, and the public copy — lagging behind by design — will periodically look "higher" by string comparison alone. There is no way to extend Magento's list without forking it. This package is that fork.

Installation

composer require pixelperfectat/composer-dependency-audit-plugin

Composer plugins must be explicitly allowed to run:

{
    "config": {
        "allow-plugins": {
            "pixelperfectat/composer-dependency-audit-plugin": true
        }
    }
}

This package declares replace: {"magento/composer-dependency-version-audit-plugin": "*"}, so it satisfies any existing requirement on the original package — including one pulled in transitively by magento/framework — without installing it. A root composer.json that already requires magento/composer-dependency-version-audit-plugin does not need to remove that line; replace satisfies it. Do not require both packages as separate installs — only one dependency-confusion plugin can own the install-time check, and having both active is redundant at best.

Configuring the allow list

Add an extra block to the root composer.json, naming the vendor namespaces to exempt from the comparison:

{
    "extra": {
        "pixelperfectat/dependency-audit": {
            "allow-vendors": ["your-vendor-namespace"]
        }
    }
}

Vendor names are matched case-insensitively. Magento's original, unconditional list (the vendors bundled with Magento commerce editions) is always included and cannot be removed — this package only adds to it, it never narrows it.

The guard stays active for everyone else

Allow-listing a vendor only exempts packages under that vendor's namespace. Every other package — including third-party dependencies with ordinary version ranges — is still checked exactly as Magento's original plugin checks it. Removing a vendor from the list, or misconfiguring the extra block, restores the full check for that vendor; a malformed block is treated as "nothing configured," which is the stricter behaviour, not the more permissive one.