> I have a mailing list for people who use my code, when an update is out they can download the .php files, 'require' them and test them before deployment, but never will I do packages.
This offers no benefit in terms of security, over a package dependency locked at a specific version.
The end result is the same: the user ends up downloading the .php files, and testing them in deployment, but through composer instead of curl.
It doesn't contribute to security at all, it just makes it awkward for other people to use your code.
This offers no benefit in terms of security, over a package dependency locked at a specific version.
The end result is the same: the user ends up downloading the .php files, and testing them in deployment, but through composer instead of curl.
It doesn't contribute to security at all, it just makes it awkward for other people to use your code.
I would also assume that people are connecting your library to a package management system anyway, to overcome this unnecessary hurdle e.g. https://getcomposer.org/doc/05-repositories.md#loading-a-pac...