Documented migration plan to Composer dependencies

.gitignore

@@ -5,7 +5,8 @@ composer.phar
 
 # Ignore third-party files
 phpDocumentor.phar
-e107_handlers/vendor/
+# Uncomment the following line for e107 v3. See ./e107_handlers/vendor/README.md for details.
+#e107_handlers/vendor/
 
 # Ignore user files
 .htaccess

composer.json

@@ -13,13 +13,13 @@
     "irc": "https://gitter.im/e107inc/e107",
     "source": "https://github.com/e107inc/e107"
   },
-  "require": {
-    "php": ">=5.6"
-  },
   "config": {
     "platform": {
       "php": "5.6"
     },
     "vendor-dir": "e107_handlers/vendor"
+  },
+  "require": {
+    "php": ">=5.6"
   }
 }

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "1dadee7abff6964f19b82dc2c88be589",
+    "content-hash": "f117caf65293d124a673a0a20b0e6fe4",
     "packages": [],
     "packages-dev": [],
     "aliases": [],
@@ -15,5 +15,8 @@
     "platform": {
         "php": ">=5.6"
     },
-    "platform-dev": []
+    "platform-dev": [],
+    "platform-overrides": {
+        "php": "5.6"
+    }
 }

e107_handlers/vendor/.htaccess

@@ -0,0 +1,2 @@
+# Prevent anyone from browsing this folder on Apache HTTP Server
+Deny from all

e107_handlers/vendor/README.md

@@ -0,0 +1,24 @@
+# e107 v2 Core Dependencies
+
+## Interfacing with Dependencies
+
+The public interfaces in `./e107_handlers/vendor/` are not considered stable.
+
+Plugins **should not** call code inside `./e107_handlers/vendor/` directly.
+They **should** only use interfaces (handlers) provided by the e107 framework in `./e107_handlers/`.
+
+## Compatibility Note
+
+e107 has historically bundled the full source code of external dependencies in the core repository.
+Some code, particularly syncing from the GitHub remote, expects dependencies to be included in the core source.
+
+This behavior will be maintained until all existing code depending on the behavior is updated to support resolving dependencies with Composer.
+
+### Transition Plan
+
+|e107 Version|Dependency Location|Managed with Composer?|Dependencies Copied in Core Repository?|Behavior Change|
+|---|---|---|---|---|
+|`<2.3`|`./e107_handlers/`|No|Yes|Legacy behavior|
+|`^2.3`|`./e107_handlers/vendor/`|Yes|Yes|Dependencies begin moving to be managed by Composer.  Dependencies target the lowest version of PHP supported by e107 (`config.platform.php` option in `./composer.json`).|
+|`^3`|`./e107_handlers/vendor/`|Yes|No|All dependency code is deleted from the core repository's `./e107_handlers/vendor/` folder.  The e107 installer runs `composer install` at the beginning of the install process.  The e107 self-updater runs `composer install` after deploying the desired e107 version.  Only e107 releases may have dependencies bundled in the release package for offline/Intranet/firewalled installations.
+