v1.7.0

v1.7.0 — Mutable dev branches & path-repository support

Adds first-class handling for two kinds of dependencies the immutable-pin model previously couldn't cope with: local path repositories and intentionally-mutable dev branches.

Added

• soak-time-dev-branches — opt-in mutable dev versions. Dev versions (dev-main, 1.x-dev, …) advance their git SHA every time the branch moves, which used to make composer update hard-fail once a pinned reference drifted. Declare such packages and the plugin re-pins them on each advance instead of blocking:

{
    "extra": {
        "soak-time-dev-branches": ["your-company/my-lib", "your-company/*"]
    }
}

• Also settable per-run via SOAK_TIME_DEV_BRANCHES=your-company/my-lib composer update (comma-separated). Patterns follow the whitelist rules — literal vendor, * allowed only in the name half. Re-pinning is keyed solely on the git source reference (the unforgeable commit SHA): if the SHA is held fixed but the downloaded archive's sha256 differs, the plugin still hard-fails, since that's cache poisoning rather than a branch advance. Undeclared dev drift is blocked with an error that names the config key.

Fixed

• Local path repositories no longer break installs. A path-repo dependency has no dist archive hash and no source reference, so the integrity recorder threw Cannot pin integrity for <pkg>@dev-master and failed every install. Path packages are local code in the same trust domain as the root project, so they're now exempt from integrity pinning and drift checks. The exemption is gated on the dist URL actually being a local filesystem path, so a remote package can't dodge integrity checks by merely claiming dist.type: path.

Internal

• Folded the mutable-dev gate into a single mutableDevAdvanced() predicate so re-pinning can never be triggered for a non-dev or undeclared package. No behavior change.
• Test suite: 73 tests, 141 assertions.

Full Changelog: v1.6.0...v1.7.0