Isolate /vendor dependencies to avoid conflicts with other plugins and packages

[kasparsd]

The FAIR plugin now pulls in fairpm/did-manager-wordpress as a Composer dependency, which is also bundled with the release ZIP file under the vendor directory.

There is now a potential conflict due to duplicate code being loaded if another plugin or the WP application loads another instance of the fairpm/did-manager-wordpress dependency (possibly at different versions).

Other major WP plugins solve this in different ways:

• Yoast SEO uses php-scoper via a Composer plugin.

• Jetpack and WooCommerce use a custom Jetpack autoloader that attempts to load the latest version of each package.

Composer Setups

For projects using Composer to manage global dependencies (where FAIR itself is added via Composer), we need to solve the following question:

1. Should we skip FAIR's autoloader for external packages (currently included via require_once __DIR__ . '/vendor/autoload.php' in the plugin bootstrap file) if the projects already use global Composer autoload and have access to all our dependencies (because of require in `composer.json)?

2. If we do isolate vendor dependencies, should the published an adjusted composer.json file that doesn't list the require dependencies so that projects adding FAIR via Composer don't pull in non-vendored dependencies that we don't actually use?

[craigrileyuk]

Definitely agree with this. We can't update to 1.4 of Fair because of dependency conflicts.