Composer Admin UI

The Composer dependencies card, on the Dependencies tab of the Loopress page, lets you browse Packagist and install PHP packages directly from your WordPress admin, without SSH access.

Where packages are stored

Loopress Full maintains its own composer.json under wp-content/loopress/. Installed packages land in wp-content/loopress/vendor/. This location is separate from the plugin itself so packages survive plugin updates and can be used anywhere on the site via the Composer autoloader.

wp-content/
  loopress/
    composer.json        ← managed by Loopress Full
    vendor/
      autoload.php       ← require this in your snippets
      guzzlehttp/guzzle/
      ...

Installing a package

1. Type the package name or a keyword in the Search a Composer package field (minimum 2 characters)
2. Select the package from the dropdown
3. Choose a version (compatible versions are pre-selected automatically based on your PHP version)
4. Click Install

Each version in the picker says when it is not a safe pick: requires PHP x when it needs a different PHP version than the server runs, PHP compatibility unknown when the package declares no PHP constraint.

Removing a package

In the Installed packages list, click Remove next to the package you want to uninstall, then confirm.

Updating a package

The Installed packages list checks each installed package against Packagist. If a newer version is available, an “update: x.y.z” badge appears next to the current version, and an Update button runs composer require to install the latest version in place.

Production sites and read-only mode

Changes made from the admin edit the site’s own composer.json: run lps composer pull afterwards to bring them back into your repository.

• Removing a package always asks for a confirmation. On a site whose environment type is production (WordPress’s default), installing and updating ask too, and every confirmation names the production site. The environment is shown as a badge next to the page title.
• When DISALLOW_FILE_MODS is set to true in wp-config.php (or the file_mod_allowed filter returns false), dependencies are read-only: the search field and every action are hidden, and every Composer endpoint that writes files answers 403, including the one lps composer push uses. Change dependencies in your repository and deploy them another way.

Repair

The Repair action runs composer update against wp-content/loopress/composer.json. Use it when:

• The autoloader is missing after a server migration
• The lockfile has drifted from composer.json
• A previous install left the dependencies in an inconsistent state

The autoload error banner at the top of the page appears automatically when Loopress Full detects a missing or broken autoloader, and runs Repair on its own. Under DISALLOW_FILE_MODS it only reports the problem.

REST API

Outdated packages are exposed at GET /wp-json/loopress/v1/composer/outdated:

[
  {
    "name": "some/package",
    "version": "1.2.0",
    "latest": "1.4.2"
  }
]

Notes

• Composer is executed in-process (via the composer/composer library). Long-running installs extend the PHP execution time limit to 5 minutes automatically.
• Only stable versions are shown in the version picker (no dev-* releases).