How to completely DISABLE auto-updates when composer-installed?

  • I installed WordPress 6.2 with composer.

    All my plugins & themes are composer installed too.

    My goal is to only update using composer and get my install to stop making attempts to auto-update anything and sending me emails about it.

    In the WP Admin UI there’s no option to auto-enable plugins anymore.
    I expect that since it’s composer managed.

    In my config there’s

    define('AUTOMATIC_UPDATER_DISABLED', true);
    define('DISALLOW_FILE_EDIT', true);
    define('DISALLOW_FILE_MODS', true);

    and in functions.php I have

    add_filter( 'plugins_auto_update_enabled', '__return_false' );
    add_filter( 'themes_auto_update_enabled', '__return_false' );

    But I’m still getting email notices from WP that it’s auto-updating like this


    ~~~~~~~~~~~~~~~~~
    Howdy! Some plugins have automatically updated to their latest versions on your site at https://residentinfo.net. No further action is needed on your part.

    These plugins are now up to date:
    – Conditional Fields for Contact Form 7 (from version 2.3.6 to 2.3.7) : https://www.ads-software.com/plugins/cf7-conditional-fields/

    If you experience any issues or need support, the volunteers in the www.ads-software.com support forums may be able to help.
    https://www.ads-software.com/support/forums/

    The WordPress Team
    ~~~~~~~~~~~~~~~~~

    Problem is that it’s auto-updating when I’ve told it not to.

    And, it’s not actually correct. The plugin it says it just updated and is up to date just isnt’.

    In the Admin UI it shows as the old version (still 2.3.6 in this example).

    And if update with composer manually it DOES update:


    composer update
    Loading composer repositories with package information
    Info from https://repo.packagist.org: #StandWithUkraine
    Updating dependencies
    Lock file operations: 0 installs, 1 updates, 0 removals
    – Upgrading wpackagist-plugin/cf7-conditional-fields (2.3.6 => 2.3.7)
    Writing lock file
    Installing dependencies from lock file (including require-dev)
    Package operations: 0 installs, 1 updates, 0 removals
    – Downloading wpackagist-plugin/cf7-conditional-fields (2.3.7)
    – Upgrading wpackagist-plugin/cf7-conditional-fields (2.3.6 => 2.3.7): Extracting archive
    Generating optimized autoload files
    16 packages you are using are looking for funding.
    Use the composer fund command to find out more!

    composer show wpackagist-plugin/cf7-conditional-fields
    name : wpackagist-plugin/cf7-conditional-fields
    descrip. :
    keywords :
    versions : * 2.3.7
    type : wordpress-plugin
    homepage : https://www.ads-software.com/plugins/cf7-conditional-fields/
    source : [svn] https://plugins.svn.www.ads-software.com/cf7-conditional-fields/ tags/2.3.7
    dist : [zip] https://downloads.www.ads-software.com/plugin/cf7-conditional-fields.2.3.7.zip
    path : /home/gson/wordpress/web/app/plugins/cf7-conditional-fields
    names : wpackagist-plugin/cf7-conditional-fields

    requires
    composer/installers ^1.0 || ^2.0

    • This topic was modified 1 year, 7 months ago by bcworkz. Reason: formatting fixed
Viewing 3 replies - 1 through 3 (of 3 total)
  • Moderator bcworkz

    (@bcworkz)

    It’s possible composer completely ignores WP update management. I recommend asking for help in its dedicated support channel.

    Thread Starter gladsong

    (@gladsong)

    composer here isn’t responsible for the update attempts or the notifications.
    it’s WP that’s ignoring the WP settings to stop updates.


    Moderator bcworkz

    (@bcworkz)

    WP wouldn’t do so on its own. Some add-on is overriding your attempts. Unfortunately, the usual technique of switching themes and deactivating plugins isn’t very informative if you cannot test on demand.

    Filters take precedence over constants. Hooking with a large priority helps ensure your callback has the final say. ‘file_mod_allowed’ filter AFAICT overrides other directives. Try:
    add_filter('file_mod_allowed', '__return_false', PHP_INT_MAX);

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘How to completely DISABLE auto-updates when composer-installed?’ is closed to new replies.