Source: civicrm
Severity: normal
X-Debbugs-Cc: pkg-php-p...@lists.alioth.debian.org

Hi Dmitry,

civicrm-common depends on composer, it seems like it is used as a
dynamic autoloader:

https://salsa.debian.org/debian/civicrm/-/blob/master/debian/autoload-vendor.php.tpl#L11

Please, do drop the dependency on composer and use proper static
autoloader(s) instead. There is work in progress to make that task
mostly automatic in the future, but relying on composer to make every
PHP library installed on the system available to civicrm seems like a
very bad idea (maybe even a security issue).

https://salsa.debian.org/php-team/pear/pkg-php-tools/-/merge_requests/6

Regards

David

Attachment: signature.asc
Description: PGP signature

Reply via email to