WP Org Closed Plugin

Composer plugin to mark packages as abandoned if closed on WordPress.org

Built with ♥ by Typist Tech

---

Usage

Once installed, use composer as usual.

$ composer audit
No security vulnerability advisories found.
Found 1 abandoned package:
+------------------------------------+-----------------------+
| Abandoned Package                  | Suggested Replacement |
+------------------------------------+-----------------------+
| wpackagist-plugin/my-closed-plugin | none                  |
+------------------------------------+-----------------------+

$ composer show wpackagist-plugin/my-closed-plugin

# ...
names    : wpackagist-plugin/my-closed-plugin
Attention: This package is abandoned and no longer maintained.
# ...

# The following commands show the same abandonment warning.
$ composer require
$ composer install
$ composer update

# ...
Package wpackagist-plugin/my-closed-plugin is abandoned because https://wordpress.org/plugins/my-closed-plugin has been closed, you should avoid using it. No replacement was suggested.
  - Installing wpackagist-plugin/my-closed-plugin (1.2.3): Extracting archive
# ...

---

Tip

Hire Tang Rufus!

I am looking for my next role, freelance or full-time. If you find this tool useful, I can build you more weird stuff like this. Let's talk if you are hiring PHP / Ruby / Go developers.

Contact me at https://typist.tech/contact/

---

Why

When a plugin is closed on WordPress.org, WPackagist not always remove it from its database immediately. As a result, some closed plugins remain available for installation via WPackagist.

Moreover, even if a plugin is closed, its existing versions are still downloadable from WordPress.org and the subversion repository.

{
  "repositories": [
    {
      "type": "package",
      "package": {
        "name": "my-plugin/my-closed-plugin",
        "version": "1.0",
        "source": {
          "type": "svn",
          "url": "https://plugins.svn.wordpress.org/my-closed-plugin/",
          "reference": "tags/1.0"
        }
      }
    },
    {
      "type": "package",
      "package": {
        "name": "your-plugin/your-closed-plugin",
        "version": "1.0",
        "dist": {
          "type": "zip",
          "url": "https://downloads.wordpress.org/plugin/your-closed-plugin.1.0.zip"
        }
      }
    }
  ]
}

To catch these closed plugins, WP Org Closed Plugin queries WordPress.org API to check whether a plugin is closed and mark them as abandoned in Composer.

What to do when a plugin is closed?

It depends on why the plugin is closed.

For security concerns, stop using the plugin immediately.

For plugin exodus, install the plugin via the new repository suggested by the plugin author.

For other reasons, do your own research.

Caveats

No longer maintained

Composer hardcodes the message no longer maintained for abandoned packages.

Plugins closed on WordPress.org may be closed for various reasons - some are permanent, some are temporary. The message no longer maintained may not be accurate in some cases.

You should check the plugin's WordPress.org page for more details.

No replacement was suggested

There is no way to suggest a replacement when closing a plugin on WordPress.org.

You should do your own research to find suitable replacements.

Locked File

Since plugin closure might be temporary, WP Org Closed Plugin does not modify composer.lock. Thus, $ composer audit --locked will not report closed plugins.

$ composer audit --locked

# ...
Skipped checking for closed plugins because of --locked.
# ...

You should run composer audit without --locked to check for closed plugins.

Cache

WordPress.org API responses are cached for 10 minutes.

If you must clear the cache, delete the <composer-cache-dir>/wp-org-closed-plugin directory.

rm -rf $(composer config cache-dir)/wp-org-closed-plugin

Why allow_self_signed when connecting to https://api.wordpress.org?

Important

Help Wanted!

Please send pull requests if you know how to get around the error:

$ curl --http3-only 'https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&slug=better-delete-revision'
curl: (56) ngtcp2_conn_writev_stream returned error: ERR_DRAINING

It is a hack to disallow HTTP/3, forcing HttpDownloader to use RemoteFilesystem instead of CurlDownloader.

I suspect api.wordpress.org does not properly support HTTP/3:

$ curl --http1.1 'https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&slug=better-delete-revision'
...json response

$ curl --http2 'https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&slug=better-delete-revision'
...json response

$ curl --http3-only 'https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&slug=better-delete-revision'
...sometimes json response
...but most of the time ERR_DRAINING
curl: (56) ngtcp2_conn_writev_stream returned error: ERR_DRAINING

See:

• composer/composer#12363
• https://github.com/composer/composer/blob/f5854b140ca27164d352ce30deece798acf3e36b/src/Composer/Util/HttpDownloader.php#L537
• #22

Tip

Hire Tang Rufus!

There is no need to understand any of these quirks. Let me handle them for you. I am seeking my next job, freelance or full-time.

If you are hiring PHP / Ruby / Go developers, contact me at https://typist.tech/contact/

Installation

composer config allow-plugins.typisttech/wp-org-closed-plugin true
composer require typisttech/wp-org-closed-plugin

Credits

WP Org Closed Plugin is a Typist Tech project and maintained by Tang Rufus, freelance developer for hire.

Full list of contributors can be found on GitHub.

Copyright and License

This project is a free software distributed under the terms of the MIT license. For the full license, see LICENSE.

Contribute

Feedbacks / bug reports / pull requests are welcome.