Dev Tools · 17h ago
WordPress.org Blocks Plugin from Installing Composer Packages
Loopress, a toolset for making WordPress reproducible via Git, built a Composer UI to install PHP packages from the WordPress admin. The WordPress.org plugin review team rejected it, citing Guideline 8 that prohibits plugins from sending executable code via third-party systems. Loopress now ships two builds: a light version for the official directory and a full version with Composer management distributed separately.
Meridian48 take
The ruling highlights WordPress.org's strict security stance, but the workaround of dual builds adds maintenance complexity that may deter developers from building advanced tooling for the ecosystem.
Read the full reporting
Why wordpress.org Won't Let You Install Composer Packages From a Plugin →
DEV Community
wordpresscomposer