composer.json

{
    "name": "mwbmpartners/webms-intra",
    "description": "Internal portal platform — manifest-only composer.json for Dependabot CVE watching. We never run composer install: DreamHost shared hosting has no CLI. Libraries are vendored manually under web/_vendor/ and web/_libraries/. This file exists so Dependabot can watch Packagist for CVEs against the exact versions we ship. See DEV_NOTES.md → 'Manifest-only composer.json' for the rationale (#145).",
    "type": "project",
    "license": "proprietary",
    "homepage": "https://github.com/MWBMPartners/WebMS-Intra",
    "require": {
        "php": "^8.4",
        "kelvinmo/simplejwt": "^0.7",
        "dompdf/dompdf": "^3.1"
    },
    "config": {
        "platform": {
            "php": "8.4"
        }
    },
    "extra": {
        "manifest-only": true,
        "vendored-paths": {
            "kelvinmo/simplejwt": "web/_vendor/simplejwt/",
            "dompdf/dompdf": "web/_libraries/ (gitignored, server-managed)"
        }
    }
}