News for hackers. Stuff that matters.

A comment on What, why and how of PHP Composer. Parent comment

Re:What, why and how of PHP Composer by krapp on Thursday June 14, 2018 @07:27AM (#17310825)
You don't need (and shouldn't depend on) packagist when using Composer. You can import packages directly from Github, Bitbucket, etc., or even locally, you just have to write a bit more JSON.
[ Parent | on HN ]
Re:What, why and how of PHP Composer by mrrsm on Thursday June 14, 2018 @09:02AM (#17311303)
What do you suggest when the package you are using is pulling in other packages from packagist?
[ Parent | on HN ]
Re:What, why and how of PHP Composer by krapp on Thursday June 14, 2018 @09:28AM (#17311490)
Rewrite your composer.json to include them directly?. The lock file probably contains the actual repository URLS so once you have a dependency tree resolved you can rewrite it based on that.

But it is possible to avoid packagist. Ugly and painful maybe but possible, and YMMV regarding the effort being worth the reward. Dependency management in PHP isn't (or shouldn't be) like it is with JS/Node where there is one authoritative registry that everyone has to depend on and that can assert direct influence over the community as a result. Packagist shouldn't be the PHP package registry, but a registry.

[ Parent | on HN ]