
> For additional security you should declare the allow-plugins config with a list of packages names that are allowed to run code. See https://getcomposer.org/allow-plugins > You have until July 2022 to add the setting. Composer will then switch the default behavior to disallow all plugins. Oops, it is July now.