Download the PHP package beapi/composer-plugin-dependency-shield without Composer

On this page you can find all versions of the php package beapi/composer-plugin-dependency-shield. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of beapi/composer-plugin-dependency-shield

Informations about the package composer-plugin-dependency-shield

Dependency Shield

Composer plugin that verifies WordPress plugin header requirements (Requires PHP, Requires at least) against the project PHP version and the installed wordpress/core-implementation provider after composer install / composer update.

Also exposes a manual command: composer dependency-shield (exit code 1 on violations — useful in CI).

Requirements

Installation

Global (recommended)

One install on the machine, active on every Bedrock / Composer WP project without touching each composer.json:

On non-WordPress Composer projects the plugin stays completely silent (no output, no failure). It only runs when the root composer.json has extra.installer-paths containing type:wordpress-plugin or type:wordpress-muplugin.

Per-project (optional)

Use when you need the plugin declared in the project (e.g. CI running composer dependency-shield without a global install):

Allow the plugin in the root composer.json:

Behaviour

  1. Guard: if extra.installer-paths is missing or does not list type:wordpress-plugin / type:wordpress-muplugin, exit silently (global-install safe). Verbose (-v) explains the skip.
  2. On POST_INSTALL_CMD / POST_UPDATE_CMD and via composer dependency-shield, collect direct require packages with type wordpress-plugin or wordpress-muplugin.
  3. Resolve PHP from config.platform.php, else the lower bound of root require.php, else PHP_VERSION. The chosen source is printed.
  4. Resolve WordPress from an installed package that provides a literal wordpress/core-implementation version (e.g. roots/wordpress-no-content). Non-literal constraints (*, >=6.0, …) skip WP checks with a warning. If missing, WP checks are skipped with a warning.
  5. Discover root-level .php files in each package install path and parse headers like get_file_data() (no subdirectory scan — avoids bundled shims).
  6. Compare with version_compare(..., '>=') like WordPress core.
  7. Accumulate all mismatches, then fail hard (exit ≠ 0) with a global listing.

require-dev packages are not checked.

Ignore list

Limits / assumptions

The check runs on POST_INSTALL_CMD / POST_UPDATE_CMD, so packages are already downloaded when a violation fails the command. That is intentional: an incompatible plugin must break composer install / composer update / composer require, CI or not.

This model assumes a BeAPI-style Bedrock layout where:

Under those assumptions, a failed composer require may leave local leftovers (vendor / lock / plugin files) while Composer reverts composer.json — that local dirt is disposable and does not pollute the repository. If you do commit composer.lock or plugin trees, clean up after a failed require before committing.

Headers are only readable after download: the shield cannot prevent the network fetch, it fails the Composer command once the incompatibility is known.

Local testing on a Bedrock (or any Composer WP) project

Option A — global + path repo (recommended)

Then in any Bedrock project:

On a non-WP project (no matching installer-paths), the same commands stay silent.

Option B — path repo in the project

Ensure config.allow-plugins includes beapi/composer-plugin-dependency-shield: true.

Run the check

Or trigger hooks:

Force a failure (sanity check)

Temporarily set a low platform PHP, then re-run:

Or put a package that requires a newer WP than your core in require and run the command again.

Development / unit tests

License

GPL-3.0-or-later — see LICENSE.md.

All versions of composer-plugin-dependency-shield with dependencies

PHP Build Version
Package Version
Requires php Version >=7.4
composer-plugin-api Version ^2.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package beapi/composer-plugin-dependency-shield contains the following files

Loading the files please wait ...