Potential issue with composer audit

[rvola]

Hello @tangrufus

Following the discussion regarding the package shutdown declaration by Roots for security reasons, I ran some tests on your extension and I believe there may be an issue related to Composer commands.

Current behavior:

• composer install works correctly
• composer require also works as expected
• However, composer audit does not return any message or result
• And composer update fails because Composer can no longer reach the wp-packages server

I have attached my composer.json and composer.lock files to help reproduce the issue.

Steps to reproduce:

1. Install dependencies
2. Run: composer audit

Then also test:
bash composer update

It seems there may either be an issue with the repository declaration or an unexpected behavior related to the shutdown / unavailability of wp-packages.

(I renamed the lock file .lock.json because I couldn't upload it.)

composer.json
composer.lock.json

[rvola]

in addition

[tangrufus]

However, composer audit does not return any message or result

Which Composer version you using?

$ composer audit lists the 2 closed plugins for me:

$ composer --version
Composer version 2.9.7 2026-04-14 13:31:52
PHP version 8.5.6...

$ composer install
...
Package wp-plugin/discussions-tab-for-woocommerce-products is abandoned because https://wordpress.org/plugins/discussions-tab-for-woocommerce-products has been closed, you should avoid using it. No replacement was suggested.
...
Package wp-plugin/post-modified-date is abandoned because https://wordpress.org/plugins/post-modified-date has been closed, you should avoid using it. No replacement was suggested.
...

$ composer audit
No security vulnerability advisories found.
Found 2 abandoned packages:
+----------------------------------------------------+----------------------------------------------------------------------------------+
| Abandoned Package                                  | Suggested Replacement                                                            |
+----------------------------------------------------+----------------------------------------------------------------------------------+
| wp-plugin/discussions-tab-for-woocommerce-products | none                                                                             |
| wp-plugin/post-modified-date                       | none                                                                             |
+----------------------------------------------------+----------------------------------------------------------------------------------+

And, I can see the print the warning between names and changelog when composer show:

$ composer show wp-plugin/post-modified-date
...
names    : wp-plugin/post-modified-date
Attention: This package is abandoned and no longer maintained.

support
changelog : https://wordpress.org/plugins/post-modified-date/#developers
...

---

And composer update fails because Composer can no longer reach the wp-packages server

composer update failure is expected because wp-packages.org no longer serve their metadata.

Expected composer update output

$ composer update
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires wp-plugin/discussions-tab-for-woocommerce-products ^1.5, found wp-plugin/discussions-tab-for-woocommerce-products[1.5.9] in the lock file but not in remote repositories, make sure you avoid updating this package to keep the one from the lock file.
  Problem 2
    - Root composer.json requires wp-plugin/post-modified-date ^1.0, found wp-plugin/post-modified-date[1.0.4] in the lock file but not in remote repositories, make sure you avoid updating this package to keep the one from the lock file.

[rvola]

same version as you

[rvola]

I just ran another test on a server.

PHP 8.4.20 and Composer 2.9.5, same problem.
Composer audit returns nothing.

[tangrufus]

Do you have COMPOSER_AUDIT_ABANDONED or any of these environment variables set:

• COMPOSER_NO_AUDIT
• COMPOSER_POLICY
• COMPOSER_POLICY_*
• COMPOSER_SECURITY_BLOCKING_ABANDONED
  (there might be more could cause the problem, see https://getcomposer.org/doc/03-cli.md#composer-audit-abandoned)

Tips: Run composer config --list and search for audit, abandoned, security & policy.

[rvola]

only :
[audit.abandoned] fail

[tangrufus]

I am unable to reproduce it with different PHP v8.5 / v8.4 & Composer v2.9 / v2.8 & with COMPOSER_AUDIT_ABANDONED=fail / without COMPOSER_AUDIT_ABANDONED

All of the combinations show:

Can you try modifying https://github.com/tangrufus/testing-wp-org-closed-plugin-issue-71/blob/main/.github/workflows/audit.yml to reproduce the problem?

Note that GitHub doesn't show the workflow console output to public. You should fork it and run it on your account.

[rvola]

After investigation, here's what's actually happening.

composer audit won't report anything until it has obtained — from somewhere — the information that a package is abandoned. But this
plugin only provides that information during a composer install or composer update (via PRE_PACKAGE_INSTALL / PRE_PACKAGE_UPDATE).
No event is wired to audit itself, and setAbandoned(true) writes nothing into composer.lock — only vendor/composer/installed.json
ends up holding the flag, and only if an install actually (re)downloaded the package.

The classic usage scenario therefore becomes paradoxical:

1. The user already has a vendor/ and a composer.lock (the normal state of a project).
2. They run composer update → fails, the repo no longer serves the closed package.
3. They run composer audit → empty, no warning.
4. The only way to get the warning is to delete vendor/, then composer install, then composer audit.

This is counter-intuitive: you'd expect to run composer update && composer audit to validate a project's state, not to have to wipe
vendor/ to make an audit meaningful.

my-site % composer clear-cache
Clearing cache (cache-vcs-dir): /Library/Caches/composer/vcs
Clearing cache (cache-repo-dir): /Library/Caches/composer/repo
Clearing cache (cache-files-dir): /Library/Caches/composer/files
Clearing cache (cache-dir): /Library/Caches/composer
All caches cleared.

my-site % composer audit -vvv
Running 2.9.8 (2026-05-13 09:28:38) with PHP 8.5.6 on Darwin / 24.6.0
Reading ./composer.json (/my-site/composer.json)
Loading config file /.composer/config.json
Loading config file /.composer/auth.json
Loading config file ./composer.json (/my-site/composer.json)
Checked CA file /opt/homebrew/etc/ca-certificates/cert.pem: valid
Executing command (CWD): 'git' '--version'
Executing command (/my-site): 'git' 'branch' '-a' '--no-color' '--no-abbrev' '-v'
Executing command (/my-site): 'git' 'describe' '--exact-match' '--tags'
Executing command (/my-site): 'git' 'rev-list' '--no-commit-header' '--format=%H' '-n1' 'HEAD' '--no-show-signature'
Executing command (/my-site): 'hg' 'branch'
Executing command (/my-site): 'fossil' 'branch' 'list'
Executing command (/my-site): 'fossil' 'tag' 'list'
Executing command (/my-site): 'svn' 'info' '--xml'
Reading /.composer/composer.json
Loading config file /.composer/config.json
Loading config file /.composer/auth.json
Loading config file /.composer/composer.json (/.composer/composer.json)
Loading config file /.composer/auth.json
Reading /.composer/auth.json
Reading /my-site/vendor/composer/installed.json
Loading plugin Composer\Installers\Plugin (from composer/installers)
Loading plugin Pest\Plugin\Manager (from pestphp/pest-plugin)
Loading plugin Roots\Composer\WordPressCorePlugin (from roots/wordpress-core-installer)
Loading plugin TypistTech\WpOrgClosedPlugin\Plugin (from typisttech/wp-org-closed-plugin)

pre-command-run: TypistTech\WpOrgClosedPlugin\Plugin->warnLocked
Downloading https://repo.wp-packages.org/packages.json
[200] https://repo.wp-packages.org/packages.json
Writing /Library/Caches/composer/repo/https---repo.wp-packages.org/packages.json into cache
Downloading https://repo.packagist.org/packages.json
[200] https://repo.packagist.org/packages.json
Writing /Library/Caches/composer/repo/https---repo.packagist.org/packages.json into cache
Downloading https://packagist.org/api/security-advisories/
[200] https://packagist.org/api/security-advisories/
No security vulnerability advisories found.

Two possible directions to fix this:

1. Subscribe to PluginEvents::COMMAND for the audit command and run markClosedLockedPackagesIfNotAlready against the
   LockedRepository at that point.
2. Persist the abandoned flag into composer.lock during POST_UPDATE_CMD, so the information survives across clones and CI runs
   without depending on a fresh install.

Happy to help test you.

[tangrufus]

If step 2 (composer update) fails, why would you continue?

[rvola]

Yes, I understand, but what exactly is the purpose of Composer Audit? From my perspective, it's to check if we're using packages with publicly known vulnerabilities. Of course, Composer Update with a fail will indicate that something is blocking it; generally, I do a quick check of the plugin on its official URL to see if it's closed.

Without meaning to offend you (quite the opposite), what use case did you have in mind for your package?

[rvola]

Hi @tangrufus
I can close the topic, but I would have appreciated your feedback, especially regarding the use case for which you designed the component.

Thank you for your feedback.