`php-http/discovery` dependency

[brendt]

trafficstars

Every time you create a new Tempest project, you have to manually confirm that php-http/discovery is an allowed plugin. Is there a way to either get rid of this dependency, or skip the message?

[aidan-casey]

I'll have a fix for this today. 🙂

[aidan-casey]

@brendt - I'm actually having a hard time replicating this. Can you give me the steps you took to get this message?

[brendt]

I get it whenever I install tempest in a new project. Maybe you've got composer configured in a way that it remembers it?

[brendt]

In an empty folder:

composer init -ns dev
composer require tempest/framework:dev-main

Then you'll get

php-http/discovery contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "php-http/discovery" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] 

[aidan-casey]

Ah... interesting. I was using create-project and not getting it. Following these instructions, I get it.

[Treggats]

@brendt @aidan-casey

We have the following in our composer.json With which we don't have to accept it every time

 "config": {
        "platform": {
            "php": "8.3.0"
        },
        "preferred-install": "dist",
        "secure-http": false,
        "sort-packages": true,
        "optimize-autoloader": true,
        "classmap-authoritative": false,
        "allow-plugins": {
            "php-http/discovery": true,
            "phpstan/extension-installer": true
        }
    },

[aidan-casey]

@Treggats if you check the framework composer, I had added this as well. The question is why it is prompting when following the steps @brendt gave.

[aidan-casey]

So what's happening is it needs to be in the root project directory composer. Naturally with create-project it would be since we have control over that template, but it won't be when requiring into an existing project.

I'll look into what we can do with that dependency.

[brendt]

FWIW, I rather ditch the dependency and have people require it manually if they need it (which from what I understand, not many people will)

[brendt]

I removed it for now.

[aidan-casey]

@brendt - This is now fixed for requiring tempest/console and tempest/http. Because a new version hasn't been tagged, you have to specify dev-main.

It will still alert for tempest/http-client, but I am thinking that is fine. It won't alert with a project scaffold (e.g., tempest/app) because those composer files allow the plugin.

[brendt]

Well I still had to confirm on a composer create-project, I don't understand why we need this 😂

[aidan-casey]

@brendt you need to make sure you are using dev-main. The latest tag in Packagist is way old.

It's for the PSR adapter that you dislike so much. Rather than requiring the developer to pass a certain HTTP client, it will discover any PSR client installed in composer, cache it, and use it by default.

[brendt]

But we already require diactoros, will a user-based library get precedence?