Do you support the packagist v2 metadata format?

[jeffwidman]

While working on:

• The PHP composer features should use the v2 metadata from Packagist dependabot/dependabot-core#3010

I was updating our test fixtures to match what the new packagist v2 metadata API returned, and noticed that we have several test fixtures for wpackagist responses:

• https://github.com/dependabot/dependabot-core/blob/96149f09266936dc6795dfbd840fcc21b35a3464/composer/spec/fixtures/wpackagist_response.json
• https://github.com/dependabot/dependabot-core/blob/96149f09266936dc6795dfbd840fcc21b35a3464/composer/spec/fixtures/packagist_responses/wpackagist-plugin--acf-to-rest-api.json

As far as I can tell, these responses don't have an equivalent v1->v2 metadata response, so I don't need to update them at all... Is there any plans for that in the future?

Also, my apologies if I misunderstand how wpackagist works... I'm a bit unclear as it seems like it's trying to match the packagist interface for wordpress plugins that are only available via SVN and not via repo.packagist.org, but maybe that's not the intent?

[NoelLH]

Hi @jeffwidman, I think that summary matches my understanding of what Wpackagist is doing. Certainly the source code has to come via SVN because that's how the WordPress repository keeps it.

I'm not aware of imminent plans to add v2-specific properties, but I'm not against it if there is some benefit. This is why I made #408 where this was discussed blocked I think, as I am not clear what particular properties would be helpful to add in terms of use alongside Dependabot.

I think it's safe to say that if nobody with a deeper understanding proposes specific additions, we'll probably stick to v1 metadata for right now.

[jeffwidman]

Sticking with v1 sounds reasonable for now.

For v2, the two primary benefit we saw on Dependabot were:

1. minified metadata reduced filesizes significantly for packages that had released many versions. If wpackagist already truncates the versions to only the last few releases, then this will be minimal benefit.
2. some caching / update frequency benefits, but those were specific to packagist, and won't be applicable to wpackagist.

[NoelLH]

Thanks for confirming @jeffwidman. I'll close this for now, but certainly open to any more thoughts anyone has on this.

[onspli]

Hi @NoelLH , I am facing the requirement to use JFrog Artifactory to mirror Wordpress Packagist. However Artifactory does not support composer v1 repository format; it needs "metadata-url": "/p2/%package%.json" endpoint to be implemented.

Are there any plans to support this format or are there any blockers? I have the resources to implement this feature myself, would you be open to a PR?

[jeffwidman]

IF this endpoint does get implemented, please let us over in know so that we update our test fixture responses... I'm subscribed to this issue for updates, but feel free to file an issue (or even directly open a PR) against https://github.com/dependabot/dependabot-core/ in case I don't see this for some reason.