Skip to content

Conversation

@rhoerr
Copy link
Contributor

@rhoerr rhoerr commented Nov 30, 2025

Based on the discussions in magento/magento2#36543 and magento/magento2#34562, this removes all composer replace and extra references to these packages:

        "blueimp/jquery-file-upload": "5.6.14",
        "components/jquery": "1.11.0",
        "components/jqueryui": "1.10.4",
        "linkorb/jsmin-php": "1.1.2",
        "trentrichardson/jquery-timepicker-addon": "1.4.3",
        "twbs/bootstrap": "3.1.0"

These modules all are (or were at some time in the past) integrated into the Magento 2 core codebase. These rules were added to prevent the (mostly JS/frontend) components from being included separately, which would result in duplicate code in an installation.

However:

  1. Any such code duplication is a customization issue, and not our responsibility to constrain.
  2. Being mostly frontend components, using composer to include them in the first place would be an unusual practice.
  3. The mere inclusion of these replace rules is enough to trigger roave/security-advisories alerts, which is now audited by default as of Composer 2.9. (See Composer update failing because of security advisory #178)

Removing all references in this way should fix the audit error for Composer 2.9, and clean up in the process.

Tangentially related PR: mage-os/mageos-magento2-page-builder#9

@rhoerr rhoerr requested a review from a team as a code owner November 30, 2025 22:49
Copy link
Contributor

@michielgerritsen michielgerritsen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I checked it out locally, and everything seems to work fine. I didn't do very deep testing, but the regular add product -> checkout -> place order flow seems to work as expected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants