phpBB • Free and Open Source Forum Software

No, the cause is not specificly the proxy manager, but a new feature in Composer, and when there are multiple vendor folders (What happens if there are extensions with a vendor + phpBB itself), the extensions class map overrides phpBB's. This is a new feature in composer 2; https://getcomposer.org/d...

The only solution is not placing them online.

Nope. As then all false positives will causes your build to fail and we have a bunch of topics here about complaints why builds fail.
The epv results always have been a indication something might be wrong, not that something is wrong.

Can you please report this to the bug tracker at http://tracker.phpbb.com/ so the development team can have a look at it? UPDATE: I just discussed it with Marc, and it looks like the cause is composer 2. It looks like things will be broken for extensions when using composer 2, and a extension will n...

The more I think about this, the more it becomes a phpBB bug to me... I don't really get why my vendor dir is even being used at all, still. Composer is only used for dependency management of phpBB itself, so why does it use a folder in some "random" extension subdir? This extension is on...

It can also be a false positive, for example on a second composer.json which is from a different package . It indeed won't be repacked, as explained in the policies, as this falls under the insta-deny rules.

The same message regarding fail is shown on Travis, and github actions (line 15 of your screenshot). As said, messages from epv require in most cases review, and as such it is in most cases not a automatic failure.

The problem is that ocramius/proxy-manager greater than 2.1.x requires PHP version greater than 7.1.0, which would break the minimum required version of phpBB 3.3.x (7.1.3) 7.1.3 is greater than 7.1.0? :) That PR is also not yet included in the latest stable release. I think that if you run a git v...

Yes, that's by design. Only real fatal errors will cause a build failure, issues that require looking at before will not cause failure during build. Epv is meant to be a tool to warn us about issues, and a warning from it doesn't mean it is wrong. This has always be the case, even going back to mpv.

You need to replace GPL-2.0 with GPL-2.0-only as the error says. This has been in EPV for nearly 3 years.